From 00d652454c96b48427b1ee2a76777101b66a9400 Mon Sep 17 00:00:00 2001
From: Tim Cappalli <tim@cloudauth.dev>
Date: Wed, 12 Jul 2023 19:35:48 +0000
Subject: [PATCH] Merge pull request #1901 from w3c/tc-featdetc-ispaa

SHA: 5bd3dd1ccffcbdc50873d551fbd1606e4023340d
Reason: push, by timcappalli

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 1209 +++++++++++++++++++++++++++-------------------------
 1 file changed, 618 insertions(+), 591 deletions(-)

diff --git a/index.html b/index.html
index 6ef202372..a3aa030dc 100644
--- a/index.html
+++ b/index.html
@@ -4,9 +4,9 @@
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <title>Web Authentication: An API for accessing Public Key Credentials - Level</title>
   <meta content="ED" name="w3c-status">
-  <meta content="Bikeshed version 5edf5e459, updated Thu Jun 22 11:28:01 2023 -0700" name="generator">
+  <meta content="Bikeshed version b06c00b8e, updated Tue Jul 11 13:41:16 2023 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="e165bc1131e8a111fb3a15d0439ae21ac31290dc" name="document-revision">
+  <meta content="5bd3dd1ccffcbdc50873d551fbd1606e4023340d" name="document-revision">
 <style type="text/css">
 body {
     counter-reset: table;
@@ -914,7 +914,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2023-06-28">28 June 2023</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2023-07-12">12 July 2023</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1060,8 +1060,9 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#sctn-storeCredential"><span class="secno">5.1.5</span> <span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span></a>
         <li><a href="#sctn-preventSilentAccessCredential"><span class="secno">5.1.6</span> <span class="content">Preventing Silent Access to an Existing Credential - PublicKeyCredential’s <code>[[preventSilentAccess]](credential, sameOriginWithAncestors)</code> Method</span></a>
         <li><a href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.7</span> <span class="content">Availability of <span>User-Verifying Platform Authenticator</span> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span></a>
-        <li><a href="#sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8</span> <span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span></a>
-        <li><a href="#sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9</span> <span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span></a>
+        <li><a href="#sctn-isPasskeyPlatformAuthenticatorAvailable"><span class="secno">5.1.8</span> <span class="content">Availability of a <span>passkey platform authenticator</span> - PublicKeyCredential’s <code>isPasskeyPlatformAuthenticatorAvailable()</code> Method</span></a>
+        <li><a href="#sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.9</span> <span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span></a>
+        <li><a href="#sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.10</span> <span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span></a>
        </ol>
       <li>
        <a href="#iface-authenticatorresponse"><span class="secno">5.2</span> <span class="content">Authenticator Responses (interface <span><code>AuthenticatorResponse</code></span>)</span></a>
@@ -2031,6 +2032,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-discoverable-public-key-credential-source">Client-side discoverable Public Key Credential Source</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-discoverable-credential">Client-side discoverable Credential</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="discoverable-credential">Discoverable Credential</dfn>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="passkey">Passkey</dfn>
     <dt data-md>[DEPRECATED] <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="resident-credential">Resident Credential</dfn>
     <dt data-md>[DEPRECATED] <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="resident-key">Resident Key</dfn>
     <dd data-md>
@@ -3469,19 +3471,34 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-isUserVerifyingPlatformA
 </pre>
     <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①①">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
-   <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
+   <h4 class="heading settled" data-level="5.1.8" id="sctn-isPasskeyPlatformAuthenticatorAvailable"><span class="secno">5.1.8. </span><span class="content">Availability of a <a data-link-type="dfn" href="#passkey-platform-authenticator" id="ref-for-passkey-platform-authenticator">passkey platform authenticator</a> - PublicKeyCredential’s <code>isPasskeyPlatformAuthenticatorAvailable()</code> Method</span><a class="self-link" href="#sctn-isPasskeyPlatformAuthenticatorAvailable"></a></h4>
+   <div data-link-for-hint="WebAuthentication/isPasskeyPlatformAuthenticatorAvailable">
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> use this method to determine whether they can create a new <a data-link-type="dfn" href="#passkey" id="ref-for-passkey">passkey</a> using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑤">user-verifying platform authenticator</a> or a <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid">hybrid</a></code> authenticator.
+Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑥">user-verifying platform authenticators</a> and the 
+availability of <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid①">hybrid</a></code> transport.
+If one or both are discovered, the promise is resolved with the value of <code>true</code>.
+If neither is discovered, the promise is resolved with the value of <code>false</code>.
+Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a> can take further actions to guide the user to create a <a data-link-type="dfn" href="#passkey" id="ref-for-passkey①">passkey</a>.</p>
+    <p>This method has no arguments and returns a Boolean value.</p>
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑦"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑥"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②"><c- b>boolean</c-></a>> <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isPasskeyPlatformAuthenticatorAvailable()" id="dom-publickeycredential-ispasskeyplatformauthenticatoravailable"><code><c- g>isPasskeyPlatformAuthenticatorAvailable</c-></code><a class="self-link" href="#dom-publickeycredential-ispasskeyplatformauthenticatoravailable"></a></dfn>();
+};
+</pre>
+    <p class="note" role="note"><span class="marker">Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context②">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+   </div>
+   <h4 class="heading settled" data-level="5.1.9" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.9. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseCreationOptionsFromJSON">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①③">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①③">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
 identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions③">PublicKeyCredentialCreationOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑧">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①②">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a></code> that correspond
 to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions④">PublicKeyCredentialCreationOptions</a></code>. This conversion MUST
-also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a>.</p>
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a>.</p>
     <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
 "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
-    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
-MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code> with a description of the incompatible
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code> with a description of the incompatible
 value and terminate the operation.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑦"><c- g>PublicKeyCredential</c-></a> {
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑧"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑤"><c- n>PublicKeyCredentialCreationOptions</c-></a> <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseCreationOptionsFromJSON(options)" id="dom-publickeycredential-parsecreationoptionsfromjson"><code><c- g>parseCreationOptionsFromJSON</c-></code><a class="self-link" href="#dom-publickeycredential-parsecreationoptionsfromjson"></a></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson①"><c- n>PublicKeyCredentialCreationOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseCreationOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parsecreationoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
 };
 
@@ -3513,19 +3530,19 @@ <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFrom
 };
 </pre>
    </div>
-   <h4 class="heading settled" data-level="5.1.9" id="sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9. </span><span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span><a class="self-link" href="#sctn-parseRequestOptionsFromJSON"></a></h4>
+   <h4 class="heading settled" data-level="5.1.10" id="sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.10. </span><span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span><a class="self-link" href="#sctn-parseRequestOptionsFromJSON"></a></h4>
    <div data-link-for-hint="WebAuthentication/parseRequestOptionsFromJSON">
-    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑨">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
-    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑨">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
 identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑤">PublicKeyCredentialRequestOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑨">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑧">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a></code> that correspond
 to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type①">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑥">PublicKeyCredentialRequestOptions</a></code>. This conversion MUST
-also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a>.</p>
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a>.</p>
     <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson②">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
 "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
-    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
-MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code> with a description of the incompatible
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code> with a description of the incompatible
 value and terminate the operation.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑧"><c- g>PublicKeyCredential</c-></a> {
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑨"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑦"><c- n>PublicKeyCredentialRequestOptions</c-></a> <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseRequestOptionsFromJSON(options)" id="dom-publickeycredential-parserequestoptionsfromjson"><code><c- g>parseRequestOptionsFromJSON</c-></code><a class="self-link" href="#dom-publickeycredential-parserequestoptionsfromjson"></a></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson①"><c- n>PublicKeyCredentialRequestOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseRequestOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parserequestoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
 };
 
@@ -3540,7 +3557,7 @@ <h4 class="heading settled" data-level="5.1.9" id="sctn-parseRequestOptionsFromJ
 </pre>
    </div>
    <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><span class="secno">5.2. </span><span class="content">Authenticator Responses (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorresponse"><code>AuthenticatorResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorresponse"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse" id="ref-for-authenticatorresponse③"><c- g>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject③"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
@@ -3557,7 +3574,7 @@ <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><s
    <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestationresponse"><span class="secno">5.2.1. </span><span class="content">Information About Public Key Credential (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorattestationresponse"><code>AuthenticatorAttestationResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorattestationresponse"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a>'s response to a client’s request
 for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credential</a>. It contains information about the new credential that can be used to
-identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Party</a> to assess the characteristics of the credential
+identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Party</a> to assess the characteristics of the credential
 during registration.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext②"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed②"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse③"><c- g>AuthenticatorAttestationResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse④"><c- n>AuthenticatorResponse</c-></a> {
@@ -3580,7 +3597,7 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object④">attestation object</a>, which is opaque to, and cryptographically protected against
 tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation
 statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
-contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>,
+contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a>,
 and <a href="#fig-attStructs">Figure 6</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>
      <dd data-md>
@@ -3596,13 +3613,13 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier③">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-transports-slot"><code>[[transports]]</code></dfn>
      <dd data-md>
-      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑧">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②②">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Parties</a> SHOULD accept and store unknown values.</p>
+      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑧">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②②">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Parties</a> SHOULD accept and store unknown values.</p>
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span class="secno">5.2.1.1. </span><span class="content">Easily accessing credential data</span><a class="self-link" href="#sctn-public-key-easy"></a></h5>
-   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
+   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in COSE format <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
    <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
-   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
+   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> will be null.</p>
    <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> value of:</p>
    <ul>
     <li data-md>
@@ -3613,11 +3630,11 @@ <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span
      <p>-8 (EdDSA), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9053#name-double-coordinate-curves" id="ref-for-name-double-coordinate-curves①">crv</a> is 6 (Ed25519).</p>
    </ul>
    <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm②">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public key</a>.</p>
-   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
+   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑥">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
    <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionresponse"><span class="secno">5.2.2. </span><span class="content">Web Authentication Assertion (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorassertionresponse"><code>AuthenticatorAssertionResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorassertionresponse"></a></h4>
    <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a>'s response to a client’s request for
-generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
+generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
 aware of. This response contains a cryptographic signature proving possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑧">credential private key</a>, and
 optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> to a specific transaction.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext③"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed③"><c- g>Exposed</c-></a>=<c- n>Window</c->]
@@ -3660,7 +3677,7 @@ <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②④">DOMString</a></span>
      <dd data-md>
-      <p>This member specifies the type of credential to be created. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype④">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platforms</a> MUST ignore unknown values, ignoring any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters②">PublicKeyCredentialParameters</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type③">type</a></code>.</p>
+      <p>This member specifies the type of credential to be created. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype④">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③①">client platforms</a> MUST ignore unknown values, ignoring any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters②">PublicKeyCredentialParameters</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type③">type</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-alg"><code>alg</code></dfn>, <span> of type <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑦">COSEAlgorithmIdentifier</a></span>
      <dd data-md>
       <p>This member specifies the cryptographic signature algorithm with which the newly generated credential will be used, and
@@ -3689,7 +3706,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-rp"><code>rp</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity②">PublicKeyCredentialRpEntity</a></span>
      <dd data-md>
-      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Party</a> responsible for the request.</p>
+      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Party</a> responsible for the request.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
@@ -3699,7 +3716,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
      <dd data-md>
       <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a>.</p>
       <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①②">authentication ceremonies</a>,
-and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a></p>
+and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremonies</a></p>
       <p>For further details, see <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> and <a href="#dictionary-user-credential-params">§ 5.4.3 User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource③">BufferSource</a></span>
      <dd data-md>
@@ -3708,11 +3725,11 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
 See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters④">PublicKeyCredentialParameters</a>></span>
      <dd data-md>
-      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Party</a> supports,
+      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a> supports,
 ordered from most preferred to least preferred.
-The <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
+The <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
 If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">create()</a></code> operation fails.</p>
-      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑧">COSEAlgorithmIdentifier</a></code> values:</p>
+      <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Parties</a> that wish to support a wide range of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticators</a> SHOULD include at least the following <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑧">COSEAlgorithmIdentifier</a></code> values:</p>
       <ul>
        <li data-md>
         <p>-8 (Ed25519)</p>
@@ -3724,35 +3741,35 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
       <p>Additional signature algorithms can be included as needed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
      <dd data-md>
-      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Party</a> is willing to wait for the call to complete. This is
-treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a>.</p>
+      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> is willing to wait for the call to complete. This is
+treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
 This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
-If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a>,
+If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a>,
 or return an error if that fails.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
 that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> operation.
 See <a href="#dictionary-authenticatorSelection">§ 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦">DOMString</a>, defaulting to <code>"none"</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
-Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑥">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③①">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">member does not exist</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
+Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑥">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">member does not exist</a>.</p>
       <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none③">none</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑧">DOMString</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticator</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
 This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
       <p>The default value is the empty list, which indicates no preference.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①">AuthenticationExtensionsClientInputs</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticator</a>.
-For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> that was created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticator</a>.
+For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> that was created.</p>
       <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
@@ -3760,7 +3777,7 @@ <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoption
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity"><span class="secno">5.4.1. </span><span class="content">Public Key Entity Description (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialentity"><code>PublicKeyCredentialEntity</code></dfn>)</span><a class="self-link" href="#dictionary-pkcredentialentity"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credential</a> is
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credential</a> is
 associated with or <a data-link-type="dfn" href="#scope" id="ref-for-scope①①">scoped</a> to, respectively.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity①"><c- g>PublicKeyCredentialEntity</c-></a> {
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑨"><c- b>DOMString</c-></a>    <a class="idl-code" data-link-type="dict-member" data-type="DOMString    " href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④"><c- g>name</c-></a>;
@@ -3773,16 +3790,16 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
       <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
       <ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a>, intended only
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a>, intended only
 for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".</p>
         <ul>
          <li data-md>
-          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑤">name</a></code>'s value, or displaying the value to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client③⑨">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client④⓪">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑦">authenticatorMakeCredential</a> operation.</p>
         </ul>
@@ -3792,24 +3809,24 @@ <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity
 or "+14255551234".</p>
         <ul>
          <li data-md>
-          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> SHOULD perform enforcement,
+          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Party</a> SHOULD perform enforcement,
 as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS
 IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑦">name</a></code>'s value, or displaying the value
 to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client④⓪">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client④①">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Usernames and Passwords">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑧">authenticatorMakeCredential</a> operation.</p>
         </ul>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④①">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④②">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
       <p>Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code> member’s value so that it fits within 64 bytes, if the authenticator stores the value. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-params"><span class="secno">5.4.2. </span><span class="content">Relying Party Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrpentity"><code>PublicKeyCredentialRpEntity</code></dfn>)</span><a class="self-link" href="#dictionary-rp-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Party</a> attributes when creating a new credential.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Party</a> attributes when creating a new credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③①"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨"><c- g>id</c-></a>;
 };
@@ -3818,7 +3835,7 @@ <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-para
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a></span>
      <dd data-md>
-      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
+      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-params"><span class="secno">5.4.3. </span><span class="content">User Account Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentity"><code>PublicKeyCredentialUserEntity</code></dfn>)</span><a class="self-link" href="#dictionary-user-credential-params"></a></h4>
@@ -3843,32 +3860,32 @@ <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-pa
       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑤">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⓪">user accounts</a>,
 even for <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential③">non-discoverable credentials</a>, because some authenticators always create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑤">discoverable credentials</a>.
 Thus a constant <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑥">user handle</a> would prevent a user from using such an authenticator
-with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a>.</p>
+with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a>, intended only for display. For example, "Alex Müller" or "田中倫". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a>, intended only for display. For example, "Alex Müller" or "田中倫". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.</p>
       <ul>
        <li data-md>
-        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value, or displaying the value to the user.</p>
        <li data-md>
-        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="#client" id="ref-for-client④②">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
+        <p><a data-link-type="dfn" href="#client" id="ref-for-client④③">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266" title="Preparation, Enforcement, and Comparison of Internationalized Strings Representing Nicknames">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264" title="PRECIS Framework: Preparation, Enforcement, and Comparison of Internationalized Strings in Application Protocols">[RFC8264]</a>,
 on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑨">authenticatorMakeCredential</a> operation.</p>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④③">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④④">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3" title="CSS Overflow Module Level 3">[css-overflow-3]</a>.</p>
       <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">Authenticators</a> MUST accept and store a 64-byte minimum length for a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value. Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code> member’s value so that it fits within 64 bytes. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelection"><span class="secno">5.4.4. </span><span class="content">Authenticator Selection Criteria (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorselectioncriteria"><code>AuthenticatorSelectionCriteria</code></dfn>)</span><a class="self-link" href="#dictionary-authenticatorSelection"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
 attributes.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria④"><c- g>AuthenticatorSelectionCriteria</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment①"><c- g>authenticatorAttachment</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑥"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②"><c- g>residentKey</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②"><c- b>boolean</c-></a>                      <a class="idl-code" data-default="false" data-link-type="dict-member" data-type="boolean                      " href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey②"><c- g>requireResidentKey</c-></a> = <c- b>false</c->;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean③"><c- b>boolean</c-></a>                      <a class="idl-code" data-default="false" data-link-type="dict-member" data-type="boolean                      " href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey②"><c- g>requireResidentKey</c-></a> = <c- b>false</c->;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification②"><c- g>userVerification</c-></a> = "preferred";
 };
 </pre>
@@ -3878,27 +3895,27 @@ <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelec
      <dd data-md>
       <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
 If this member is absent, then any attachment modality is acceptable.
-The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a> MUST ignore unknown values,
+The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platforms</a> MUST ignore unknown values,
 treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists①">member does not exist</a>.</p>
-      <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑨">PublicKeyCredential</a></code>,
+      <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⓪">PublicKeyCredential</a></code>,
 which can tell what <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑤">authenticator attachment modality</a> was used
 in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">get()</a></code> operation.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨">DOMString</a></span>
      <dd data-md>
-      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
+      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③">residentKey</a></code>'s values and semantics.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean③">boolean</a>, defaulting to <code>false</code></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④">boolean</a>, defaulting to <code>false</code></span>
      <dd data-md>
-      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
+      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪">DOMString</a>, defaulting to <code>"preferred"</code></span>
      <dd data-md>
-      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
-The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>.</p>
+      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> operation.
+The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③">userVerification</a></code>'s values and semantics.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class="secno">5.4.5. </span><span class="content">Authenticator Attachment Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatorattachment"><code>AuthenticatorAttachment</code></dfn>)</span><a class="self-link" href="#enum-attachment"></a></h4>
-   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④④">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremony</a>.</p>
+   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremony</a>.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment④"><c- g>AuthenticatorAttachment</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform"><c- s>"platform"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform"><c- s>"cross-platform"</c-></a>
@@ -3916,9 +3933,9 @@ <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class=
     </dl>
    </div>
    <p class="note" role="note"><span class="marker">Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options,
-sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
+sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
 authenticating on another <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑥">client device</a>; or to specifically register a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential">platform credential</a> for easier reauthentication using a
-particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">client</a> and user will then use whichever is available and convenient at the time.</p>
+particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> and user will then use whichever is available and convenient at the time.</p>
    <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement"><span class="secno">5.4.6. </span><span class="content">Resident Key Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-residentkeyrequirement"><code>ResidentKeyRequirement</code></dfn>)</span><a class="self-link" href="#enum-residentKeyRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement②"><c- g>ResidentKeyRequirement</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged③"><c- s>"discouraged"</c-></a>,
@@ -3927,29 +3944,29 @@ <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement">
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement③">ResidentKeyRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
+   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-residentkeyrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> will evict the first.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> will evict the first.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-residentkeyrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credential</a> if possible.
-For example, the <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credential</a> if possible.
+For example, the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-residentkeyrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
+   <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
 This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
    <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><span class="secno">5.4.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-conveyance">Attestation Conveyance</dfn> Preference Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-attestationconveyancepreference"><code>AttestationConveyancePreference</code></dfn>)</span><a class="self-link" href="#enum-attestation-convey"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference②"><c- g>AttestationConveyancePreference</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none④"><c- s>"none"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect①"><c- s>"indirect"</c-></a>,
@@ -3962,27 +3979,27 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a>, or to save a
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>. For example, in order to
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
 If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
       <p>This is the default, and unknown values fall back to the behavior of this value.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;indirect&quot;|indirect" id="dom-attestationconveyancepreference-indirect"><code>indirect</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a>,
-but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a>.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a>,
+but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a>.
 The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
-in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
-      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> in this case.
-For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> through unmodified.</p>
+in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> in this case.
+For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a> through unmodified.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;direct&quot;|direct" id="dom-attestationconveyancepreference-direct"><code>direct</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;enterprise&quot;|enterprise" id="dom-attestationconveyancepreference-enterprise"><code>enterprise</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
-      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
+      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><span class="secno">5.5. </span><span class="content">Options for Assertion Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptions"><code>PublicKeyCredentialRequestOptions</code></dfn>)</span><a class="self-link" href="#dictionary-assertion-options"></a></h3>
@@ -4005,61 +4022,61 @@ <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><
      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑤">unsigned long</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> is willing to wait for the call to complete.
-The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a>.</p>
+     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a> is willing to wait for the call to complete.
+The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①">USVString</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
 The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a> MUST verify
 that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>.</p>
      <p>If not specified, its value will
 be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object④">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>.
+     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>.
 It can be used in two ways:</p>
      <ul>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a>.
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a>.
 This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.</p>
        <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨">transports</a></code> whenever possible.
-This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> optimize the user experience for any given situation.
-Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> —
-the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> will automatically ignore non-eligible credentials
+This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> optimize the user experience for any given situation.
+Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> —
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> will automatically ignore non-eligible credentials
 if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code>.</p>
        <p>See also the <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a> privacy consideration.</p>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a> to authenticate is not already identified,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> or unspecified.
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> or unspecified.
 In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a>,
 and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code>.
-If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a>,
-the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
+If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>,
+the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a> for the user to select from (see <a href="#authenticatorGetAssertion-prompt-select-credential">step 7</a> of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
      </ul>
      <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
      <p>The list is ordered in descending order of preference: the first item in the list is the most
 preferred credential, and the last is the least preferred.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④④">DOMString</a>, defaulting to <code>"preferred"</code></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>'s values and semantics.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤">DOMString</a>, defaulting to <code>"none"</code></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a>.
-Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a>.
+Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>.</p>
      <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑤">none</a></code>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a>.
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
 This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
      <p>The default value is the empty list, which indicates no preference.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs③">AuthenticationExtensionsClientInputs</a></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a>.</p>
      <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a> for an up-to-date list
@@ -4101,7 +4118,7 @@ <h4 class="heading settled" data-level="5.7.3" id="iface-authentication-extensio
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorInputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑤">CBOR</a> map
 containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
-   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a>.</p>
+   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a>.</p>
    <h4 class="heading settled" data-level="5.7.4" id="iface-authentication-extensions-authenticator-outputs"><span class="secno">5.7.4. </span><span class="content">Authentication Extensions Authenticator Outputs (CDDL type <code>AuthenticationExtensionsAuthenticatorOutputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-outputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorOutputs = {
   * $$extensionOutput .within ( tstr => any )
@@ -4114,7 +4131,7 @@ <h3 class="heading settled" data-level="5.8" id="sctn-supporting-data-structures
    <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
 follows.</p>
    <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span class="secno">5.8.1. </span><span class="content">Client Data Used in <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature">WebAuthn Signatures</a> (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-collectedclientdata"><code>CollectedClientData</code></dfn>)</span><a class="self-link" href="#dictionary-client-data"></a></h4>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a>. It is a key-value
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a>. It is a key-value
 mapping whose keys are strings. Values can be any type that has a valid encoding in JSON. Its structure is defined by the
 following Web IDL.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata②">CollectedClientData</a></code> may be extended in the future. Therefore it’s critical when parsing to be tolerant of unknown keys and of any reordering of the keys. See also <a href="#clientdatajson-verification">§ 5.8.1.2 Limited Verification Algorithm</a>.</p>
@@ -4123,7 +4140,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑨"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⓪"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin②"><c- g>topOrigin</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean                      " href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin②"><c- g>crossOrigin</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑤"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean                      " href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin②"><c- g>crossOrigin</c-></a>;
 };
 
 <c- b>dictionary</c-> <dfn class="idl-code" data-dfn-type="dictionary" data-export id="dictdef-tokenbinding"><code><c- g>TokenBinding</c-></code><a class="self-link" href="#dictdef-tokenbinding"></a></dfn> {
@@ -4142,7 +4159,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
 attacks (where an attacker substitutes one legitimate signature for another).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤">DOMString</a></span>
      <dd data-md>
       <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a> of the requester, as provided to the authenticator by the client, in
@@ -4152,38 +4169,38 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
       <p>This OPTIONAL member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-environment-top-level-origin" id="ref-for-concept-environment-top-level-origin③">top-level origin</a> of the requester, in the syntax defined
 by <a data-link-type="biblio" href="#biblio-rfc6454" title="The Web Origin Concept">[RFC6454]</a>. It is set only if the call was made from context that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors③">same-origin with its
 ancestors</a>, i.e. if <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin③">crossOrigin</a></code> is <code>true</code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-crossorigin"><code>crossOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑤">boolean</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-crossorigin"><code>crossOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑥">boolean</a></span>
      <dd data-md>
       <p>This OPTIONAL member contains the inverse of the <code>sameOriginWithAncestors</code> argument value
 that was passed into the <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑨">internal method</a>.</p>
      <dt data-md>[RESERVED] <dfn data-dfn-for="CollectedClientData" data-dfn-type="dfn" data-noexport id="collectedclientdata-tokenbinding">tokenBinding<a class="self-link" href="#collectedclientdata-tokenbinding"></a></dfn>
      <dd data-md>
       <p>This OPTIONAL member contains information about the state of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1">Token Binding</a> protocol <a data-link-type="biblio" href="#biblio-tokenbinding" title="The Token Binding Protocol Version 1.0">[TokenBinding]</a> used when communicating
-with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
+with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
       <p class="note" role="note"><span class="marker">Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding">tokenBinding</a></code> field is reserved so that it will not be reused for a different purpose.</p>
       <div>
        <dl>
         <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑦">DOMString</a></span>
         <dd data-md>
-         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
+         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn-3/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">member does not exist</a>. When known, this member is one of the following:</p>
          <div>
           <dl>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;supported&quot;|supported" id="dom-tokenbindingstatus-supported"><code>supported</code></dfn>
            <dd data-md>
-            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Party</a>.</p>
+            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>.</p>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;present&quot;|present" id="dom-tokenbindingstatus-present"><code>present</code></dfn>
            <dd data-md>
-            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
+            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
           </dl>
          </div>
          <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus①">TokenBindingStatus</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
         <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑧">DOMString</a></span>
         <dd data-md>
          <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪">base64url
-encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a>.</p>
+encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a>.</p>
        </dl>
       </div>
-      <p class="note" role="note"><span class="marker">Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platform</a>-specific operation.</p>
+      <p class="note" role="note"><span class="marker">Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platform</a>-specific operation.</p>
     </dl>
     <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata④">CollectedClientData</a></code> structure is used by the client to compute the following quantities:</p>
     <dl>
@@ -4376,27 +4393,27 @@ <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descrip
 </pre>
    <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a>.
 It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a>,
-and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a>.
-It mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⓪">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code>.</p>
+and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a>.
+It mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥①">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
-      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code>.</p>
+      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
+      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑨">BufferSource</a></span>
      <dd data-md>
       <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to.</p>
-      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code>.</p>
+      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥②">DOMString</a>></span>
      <dd data-md>
-      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platforms</a> MUST ignore unknown values.</p>
+      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">client platforms</a> MUST ignore unknown values.</p>
       <p>This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
-of a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> operation.
+of a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code> operation.
 When <a href="#sctn-registering-a-new-credential">registering a new credential</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>.
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>.
 When creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> for that credential,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a> SHOULD retrieve that stored value
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a> SHOULD retrieve that stored value
 and set it as the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> member.</p>
     </dl>
    </div>
@@ -4406,15 +4423,15 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-nfc" id="ref-for-dom-authenticatortransport-nfc"><c- s>"nfc"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-ble" id="ref-for-dom-authenticatortransport-ble"><c- s>"ble"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-smart-card" id="ref-for-dom-authenticatortransport-smart-card"><c- s>"smart-card"</c-></a>,
-    <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid"><c- s>"hybrid"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid②"><c- s>"hybrid"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal①"><c- s>"internal"</c-></a>
 };
 </pre>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport④">AuthenticatorTransport</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">clients</a>. This enumeration
+     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
@@ -4466,23 +4483,23 @@ <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirem
     <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged②"><c- s>"discouraged"</c-></a>
 };
 </pre>
-   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> for some of its operations but not for others, and may use this type to express its
+   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> for some of its operations but not for others, and may use this type to express its
 needs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑤">UserVerificationRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
 response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a> set.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> cannot be performed.</p>
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation if possible, but will not fail the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a> for the operation if possible, but will not fail the
 operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
@@ -4491,27 +4508,27 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
 the feature-identifier tokens "<code><dfn data-dfn-type="dfn" data-export data-lt="publickey-credentials-create-feature" id="publickey-credentials-create-feature">publickey-credentials-create<a class="self-link" href="#publickey-credentials-create-feature"></a></dfn></code>"
 and "<code><dfn class="dfn-paneled" data-dfn-type="dfn" data-export data-lt="publickey-credentials-get-feature" id="publickey-credentials-get-feature">publickey-credentials-get</dfn></code>".
 Their <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature-default-allowlist" id="ref-for-policy-controlled-feature-default-allowlist">default allowlists</a> are both '<code>self</code>'. <a data-link-type="biblio" href="#biblio-permissions-policy" title="Permissions Policy">[Permissions-Policy]</a></p>
-   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy③">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy④">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">navigator.credentials.create({publicKey:..., ...})</a></code> or <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">navigator.credentials.get({publicKey:..., ...})</a></code> If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use③">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑨">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots②⓪">internal methods</a> does not have such access since they are invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-create-a-credential" id="ref-for-abstract-opdef-create-a-credential">Create a <code>Credential</code></a> and <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operations <a data-link-type="biblio" href="#biblio-credential-management-1" title="Credential Management Level 1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
-   <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
-To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
+   <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
+To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span class="secno">6. </span><span class="content">WebAuthn <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-model">Authenticator Model</dfn></span><a class="self-link" href="#sctn-authenticator-model"></a></h2>
    <p><a href="#sctn-api">The Web Authentication API</a> implies a specific abstract functional model for a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>. This section
 describes that <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model②">authenticator model</a>.</p>
-   <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
-Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">client platform</a>, MUST be indistinguishable
+   <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
+Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platform</a>, MUST be indistinguishable
 from the behavior specified in <a href="#sctn-api">§ 5 Web Authentication API</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys, in section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses" id="ref-for-responses">§6.2. Responses</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys, in section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses" id="ref-for-responses">§6.2. Responses</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
-the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>,
-unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Parties</a>. For instance, this abstract model does not define protocols for
+the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>,
+unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
 specific error codes are mentioned as a means of showing which error conditions MUST be distinguishable (or not) from each other
 in order to enable a compliant and secure client implementation.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
 when <a href="#sctn-createCredential">creating credentials</a> and/or when <a href="#sctn-getAssertion">generating assertions</a>, through use of <a href="#dictionary-makecredentialoptions">credential creation options</a> or <a href="#dictionary-assertion-options">assertion generation options</a>,
 respectively. The algorithms underlying the <a href="#sctn-api">WebAuthn API</a> marshal these options and pass them to the applicable <a href="#sctn-authenticator-ops">authenticator operations</a> defined below.</p>
    <p>In this abstract model, the authenticator provides key management and cryptographic signatures. It can be embedded in the
@@ -4523,12 +4540,12 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
    <p>Additionally, each authenticator has an AAGUID, which is a 128-bit identifier indicating the type (e.g. make and model) of the
 authenticator. The AAGUID MUST be chosen by the manufacturer to be identical across all substantially identical authenticators
 made by that manufacturer, and different (with high probability) from the AAGUIDs of all other types of authenticators.
-The AAGUID for a given type of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a> MAY use the AAGUID to infer certain
+The AAGUID for a given type of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> MAY use the AAGUID to infer certain
 properties of the authenticator, such as certification level and strength of key protection, using information from other sources.</p>
    <p>The primary function of the authenticator is to provide <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature①">WebAuthn signatures</a>, which are bound to various contextual data. These
 data are observed and added at different levels of the stack as a signature request passes from the server to the
 authenticator. In verifying a signature, the server checks these bindings against expected values. These contextual bindings
-are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
+are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
 referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
 its contents. To save bandwidth and processing requirements on the authenticator, the client hashes the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data④">client data</a> and
 sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a>.</p>
@@ -4541,7 +4558,7 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
      <p>The data processed by the authenticator should be small and easy to interpret in low-level code. In particular, authenticators
 should not have to parse high-level encodings such as JSON.</p>
     <li data-md>
-     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
+     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
     <li data-md>
      <p>The design aims to reuse as much as possible of existing encoding formats in order to aid adoption and implementation.</p>
    </ul>
@@ -4564,13 +4581,13 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 The formats of these signatures, as well as the procedures for generating them, are specified below.</p>
    <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span class="secno">6.1. </span><span class="content">Authenticator Data</span><a class="self-link" href="#sctn-authenticator-data"></a></h3>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a>. These bindings are
-controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a>'s assessment of the security properties of the
+controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
-software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> in the same
+software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> in the same
 format, and uses its knowledge of the authenticator to make trust decisions.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⓪">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
-limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platform</a>.</p>
+limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">client platform</a>.</p>
    <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②①">authenticator data</a> structure is a byte array of 37 bytes or more,
 laid out as shown in <a href="#table-authData">Table <span class="table-ref-following"></span></a>.</p>
    <figure class="table" id="table-authData">
@@ -4658,11 +4675,11 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
     <figcaption> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②④">Authenticator data</a> layout. The names in the Name column are only for reference within this document, and are not
         present in the actual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a>. </figcaption>
    </figure>
-   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertion</a> is generated.
+   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertion</a> is generated.
 However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> of a
 credential does not change between operations but instead remains the same for the lifetime of that credential. Secondly, it is
 validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> that
-the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a>.</p>
+the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a>.</p>
    <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> structure</dfn>:</p>
    <ul>
     <li data-md>
@@ -4693,15 +4710,15 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
    <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a> constant at zero.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
-   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
+   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
    <p>Authenticators:</p>
    <ul>
     <li data-md>
-     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Parties</a> and being possibly employed
+     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a> and being possibly employed
 as a correlation handle for the user. Authenticators MAY implement a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①②">signature counter</a>,
 i.e., on a per-authenticator basis, but this is less privacy-friendly for users.</p>
     <li data-md>
@@ -4745,25 +4762,25 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
     </table>
     <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> for future evaluation.</p>
-   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
    <ul>
     <li data-md>
      <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticators</a>:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registered</a> and/or an account recovery process in place.
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registered</a> and/or an account recovery process in place.
 For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is backed up and is protected from single device loss.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
      <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
-     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
+     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
 to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a>,
 such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
@@ -4791,9 +4808,9 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
    <p>The above examples illustrate the primary <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-type">authenticator type</dfn> characteristics:</p>
    <ul>
     <li data-md>
-     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform</a> authenticator
-— the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
-A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a>.</p>
+     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform</a> authenticator,
+or in some cases both — the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
+A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a>.</p>
     <li data-md>
      <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
     <li data-md>
@@ -4830,6 +4847,11 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
        <td> <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment③">cross-platform</a> 
        <td> <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality③">Client-side storage</a> 
        <td> <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable①">Multi-factor capable</a> 
+      <tr>
+       <th> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="passkey-platform-authenticator">Passkey platform authenticator</dfn> 
+       <td> <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment④">platform</a> (<code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑤">transport</a></code> = <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal②">internal</a></code>) or <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment④">cross-platform</a> (<code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑥">transport</a></code> = <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid③">hybrid</a></code>)
+       <td> <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality④">Client-side storage</a> 
+       <td> <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable②">Multi-factor capable</a> 
     </table>
     <figcaption> Definitions of names for some <a data-link-type="dfn" href="#authenticator-type" id="ref-for-authenticator-type③">authenticator types</a>. </figcaption>
    </figure>
@@ -4838,77 +4860,73 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 A <a data-link-type="dfn" href="#second-factor-roaming-authenticator" id="ref-for-second-factor-roaming-authenticator">second-factor roaming authenticator</a> is more likely to be used
 to authenticate on a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑦">client device</a> for the first time,
 or on a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑧">client device</a> shared between multiple users.</p>
-   <p><a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑤">User-verifying platform authenticators</a> and <a data-link-type="dfn" href="#first-factor-roaming-authenticator" id="ref-for-first-factor-roaming-authenticator①">first-factor roaming authenticators</a> enable passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication.
+   <p><a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator⑦">User-verifying platform authenticators</a> and <a data-link-type="dfn" href="#first-factor-roaming-authenticator" id="ref-for-first-factor-roaming-authenticator①">first-factor roaming authenticators</a> enable passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication.
 In addition to the proof of possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⓪">credential private key</a>,
 these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
 The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">authentication factor</a>,
-which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a>.</p>
-   <p>The four combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
+which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a>.</p>
+   <p>The combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
    <ul>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality②">credential storage modality</a> is less relevant for a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> than for a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①③">roaming authenticator</a>,
-since users using a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform authenticator</a> can typically be identified by a session cookie or the like
-(i.e., ambient credentials).</p>
-    <li data-md>
-     <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①④">roaming authenticator</a> that is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable③">discoverable credential capable</a> but not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable②">multi-factor capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#sf" id="ref-for-sf">single-factor</a> authentication without a username,
+     <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①③">roaming authenticator</a> that is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable③">discoverable credential capable</a> but not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable③">multi-factor capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#sf" id="ref-for-sf">single-factor</a> authentication without a username,
 where the user is automatically identified by the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> and possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①①">credential private key</a> is used as the only <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⓪">authentication factor</a>.
 This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a>.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑤">roaming authenticator</a> that is <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable③">multi-factor capable</a> but not <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable④">discoverable credential capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">multi-factor</a> authentication, but requires the user to be identified first
+     <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①④">roaming authenticator</a> that is <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> but not <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable④">discoverable credential capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">multi-factor</a> authentication, but requires the user to be identified first
 which risks leaking personally identifying information; see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
    </ul>
-   <p>The following subsections define the aspects <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①③">authenticator attachment modality</a>, <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality③">credential storage modality</a> and <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability②">authentication factor capability</a> in more depth.</p>
+   <p>The following subsections define the aspects <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①③">authenticator attachment modality</a>, <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality②">credential storage modality</a> and <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability②">authentication factor capability</a> in more depth.</p>
    <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment-modality"><span class="secno">6.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-attachment-modality">Authenticator Attachment Modality</dfn></span><a class="self-link" href="#sctn-authenticator-attachment-modality"></a></h4>
-   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑨">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
-and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment④">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticators</a> that
+   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑦①">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑨">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
+and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticators</a> that
 are part of the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a> as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-authenticators">platform authenticators</dfn>, while those that are reachable via cross-platform
 transport protocols are referred to as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="roaming-authenticators">roaming authenticators</dfn>.</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③②">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client
-device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
+     <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑥">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③②">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client
+device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑦">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑥">roaming authenticator</a> is attached using cross-platform transports, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cross-platform-attachment">cross-platform attachment</dfn>. Authenticators of this class are removable from, and
-can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑤">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
+     <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑤">roaming authenticator</a> is attached using cross-platform transports, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cross-platform-attachment">cross-platform attachment</dfn>. Authenticators of this class are removable from, and
+can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑤">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑥">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
 credential</dfn>.</p>
    </ul>
-   <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a> via
+   <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticator</a> via
 Bluetooth.
-In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
-while <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client device</a> and communicating with the same authenticator via Bluetooth
-would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⓪">roaming authenticator</a>.</p>
-   <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> as a "trusted device",
+In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticator</a>,
+while <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client device</a> and communicating with the same authenticator via Bluetooth
+would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a>.</p>
+   <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> as a "trusted device",
 so the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> itself acts as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①②">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①③">authentication factor</a> for future <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①①">authentication</a>.
 This gives the user the convenience benefit
-of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremonies</a>, e.g., the user will not have to dig around in
+of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⓪">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremonies</a>, e.g., the user will not have to dig around in
 their pocket for their key fob or phone.</p>
-   <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> for the first time,
+   <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> for the first time,
 on rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑨">client devices</a>, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⓪">client devices</a> shared between multiple users,
-or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticator</a>;
+or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>;
 and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> it is used with.
-A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">roaming authenticator</a> can also be used to hold
+A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticator</a> can also be used to hold
 backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
    <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
-     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client device</a>, e.g., in a secure element.
+     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
      <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can use it.</p>
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> can use it.</p>
    </ol>
    <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
    <ul>
     <li data-md>
      <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
-credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality④">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
+credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
 credential capable</dfn>.</p>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑥">client-side credential storage
 modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private keys</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
    </ul>
    <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> MAY
@@ -4920,9 +4938,9 @@ <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-ca
    <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑤">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user
 verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> can
 verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> that is
-not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a>.</p>
+not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑦">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
@@ -4956,13 +4974,13 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>rpEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
     <dt data-md><var>userEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a>.</p>
+     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a>.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
      <p>The constant Boolean value <code>true</code>.
@@ -4970,14 +4988,14 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
 wish to make a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑧">test of user presence</a> optional although WebAuthn does not.</p>
     <dt data-md><var>requireUserVerification</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> with the intention that, if any of
+     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> with the intention that, if any of
 these are known to the authenticator, it SHOULD NOT create a new credential. <var>excludeCredentialDescriptorList</var> contains a
 list of known credentials.</p>
     <dt data-md><var>enterpriseAttestationPossible</var>
@@ -4985,11 +5003,11 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑤">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a>, if any.</p>
+     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑤">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a> based on
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
@@ -5016,11 +5034,11 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
          <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror③">InvalidStateError</a></code>" and terminate the operation.</p>
         <dt data-md>does not consent to create a new credential
         <dd data-md>
-         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" and terminate the operation.</p>
+         <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" and terminate the operation.</p>
        </dl>
        <p class="note" role="note"><span class="marker">Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> is not to proceed with creating a credential,
 but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a>.
 If the user does not consent,
 the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
@@ -5038,7 +5056,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②②">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①⓪">test of user presence</a>.</p>
      <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a> fails, return an error code equivalent to
-    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①⓪">NotAllowedError</a></code>" and terminate the operation.</p>
+    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">user consent</a> has been obtained, generate a new credential object:</p>
      <ol>
@@ -5130,7 +5148,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>allowCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> (possibly filtered
+     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a> (possibly filtered
 by the client), if any.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
@@ -5145,11 +5163,11 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>attestationFormats</var>
     <dd data-md>
-     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
+     <p>A sequence of strings that expresses the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>'s preference for attestation statement formats, from most to least preferable. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> returns <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestation</a>, then it makes a best-effort attempt to use the most preferable format that it supports.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①①">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a>, if any.</p>
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span class="marker">Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
    <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> MUST perform the following procedure:</p>
@@ -5174,7 +5192,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
     <li data-md>
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove②⓪">Remove</a> any items from <var>credentialOptions</var> whose <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid③">rpId</a> is not equal to <var>rpId</var>.</p>
     <li data-md>
-     <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>" and terminate the operation.</p>
+     <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
     <li id="authenticatorGetAssertion-prompt-select-credential">
      <a class="self-link" href="#authenticatorGetAssertion-prompt-select-credential"></a> Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
     Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
@@ -5183,7 +5201,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑦">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a>.</p>
      <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">consent</a>, return an error code equivalent to
-    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
+    "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①③">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑤">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑧">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input④">authenticator extension input</a> in <var>extensions</var>.</p>
@@ -5238,7 +5256,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p class="note" role="note"><span class="marker">Note:</span> the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult④">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -5252,7 +5270,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
    <dl>
     <dt data-md><var>rpId</var>
     <dd data-md>
-     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a>.</p>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a>.</p>
    </dl>
    <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a> MUST perform the following procedure:</p>
    <ol>
@@ -5291,7 +5309,7 @@ <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><sp
      <p>Return <var>collectedDiscoverableCredentialMetadata</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
-   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①③">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
+   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①③">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
    <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
    <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-uax29" title="UNICODE Text Segmentation">[UAX29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
    <p>For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster①">grapheme cluster</a> an authenticator may remove the remainder of that cluster.</p>
@@ -5299,7 +5317,7 @@ <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><spa
      <img src="images/string-truncation.svg"> 
     <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
    </figure>
-   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
+   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster②">grapheme cluster</a> boundaries.</p>
    <p>Truncation based on UTF-8 sequences alone may cause a <a data-link-type="dfn" href="https://w3c.github.io/i18n-glossary/#dfn-grapheme-cluster" id="ref-for-dfn-grapheme-cluster③">grapheme cluster</a> to be truncated. This could make the grapheme cluster render as a different glyph, potentially changing the meaning of the string, instead of removing the glyph entirely.</p>
    <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticators</a>, user agents SHOULD:</p>
    <ol>
@@ -5324,15 +5342,15 @@ <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span c
    <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="secno">6.5. </span><span class="content">Attestation</span><a class="self-link" href="#sctn-attestation"></a></h3>
    <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a>, if possible.
 If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a> can
-produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
+produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
-enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
+enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
 MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private key</a>,
 or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>.</p>
    <p>All this information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, and optionally when exercised, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①④">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
    <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
-for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>.</p>
+for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a> to base a trust decision on.
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
     <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑤">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> from a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">create()</a></code> operation (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">attested credential
@@ -5344,7 +5362,7 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> that created it. It
 contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
 attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation
-statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
+statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
@@ -5352,7 +5370,7 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.3 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statements</a> and their underlying trust models.
-Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a>, after verifying that it
+Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a>, after verifying that it
 is cryptographically valid. This specification supports a number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type">attestation types</a>, as described in <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>.</p>
    </ol>
    <p>In general, there is no simple mapping between <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement formats</a> and <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①">attestation types</a>. For example, the
@@ -5369,16 +5387,16 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
      <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters, or those with the same names in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code>.</p>
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Parties</a> can only signal their preferences by setting the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation④">attestation</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-attestationformats" id="ref-for-dom-publickeycredentialcreationoptions-attestationformats②">attestationFormats</a></code> parameters, or those with the same names in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code>.</p>
    <p>It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">attestation statement
-formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Parties</a> will also need to
+formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Parties</a> will also need to
 understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attestation-in-assertions"><span class="secno">6.5.1. </span><span class="content">Attestation in assertions</span><a class="self-link" href="#sctn-attestation-in-assertions"></a></h4>
-   <p>Attestation is most commonly provided during credential creation. However, if supported by the authenticator and requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> using the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation③">attestation</a></code> parameter, attestation MAY be provided in <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertions</a>.</p>
+   <p>Attestation is most commonly provided during credential creation. However, if supported by the authenticator and requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> using the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-attestation" id="ref-for-dom-publickeycredentialrequestoptions-attestation③">attestation</a></code> parameter, attestation MAY be provided in <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertions</a>.</p>
    <p>Attestations in <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertions</a> could be helpful in at least the following situations:</p>
    <ol>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>, the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator④">generating authenticator</a> may have returned a meaningfully different attestation than the authenticator currently exercising the credential. Thus returning an attestation for each use of the credential allows the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> to observe these changes.</p>
+     <p>For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>, the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator④">generating authenticator</a> may have returned a meaningfully different attestation than the authenticator currently exercising the credential. Thus returning an attestation for each use of the credential allows the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> to observe these changes.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①③">attestation statement format</a> involves a 3rd-party attesting to the state of the authenticator, then returning an attestation with each use of the credential allows for the continued good health of the authenticator to be attested.</p>
    </ol>
@@ -5514,12 +5532,12 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-formats"><sp
    <h4 class="heading settled" data-level="6.5.4" id="sctn-attestation-types"><span class="secno">6.5.4. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
    <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+   <p class="note" role="note"><span class="marker">Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
 calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑥">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
-section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
+section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
 matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per <a href="#reg-ceremony-assess-trust">step 23</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
 Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②①">attestation</a> is acceptable
-under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> policy.</p>
+under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> policy.</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic-attestation">Basic Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic">Basic</dfn>)
     <dd data-md>
@@ -5537,12 +5555,12 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-attestation-types"><span
 "endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll" title="TCG Infrastructure Working Group: A CMC Profile for AIK Certificate Enrollment">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
 for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span class="marker">Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
      <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②②">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
@@ -5616,18 +5634,18 @@ <h4 class="heading settled" data-level="6.5.6" id="sctn-signature-attestation-ty
 RSASSA-PSS signature scheme defined in section 8.1.1 in <a data-link-type="biblio" href="#biblio-rfc8017" title="PKCS #1: RSA Cryptography Specifications Version 2.2">[RFC8017]</a> with SHA-256 as the hash function.
 The signature is not ASN.1 wrapped.</p>
    </ul>
-   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a>'s script receives
-a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑨">AuthenticatorAssertionResponse</a></code> structure,
-respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Party</a> server, using methods outside
-the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> must perform upon receipt of these
+   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Party</a>'s script receives
+a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑨">AuthenticatorAssertionResponse</a></code> structure,
+respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> server, using methods outside
+the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
@@ -5656,43 +5674,43 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
     <li data-md>
-     <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a>.</p>
+     <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a>.</p>
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑦">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a> expects that this credential would have been created within an iframe that is
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> expects that this credential would have been created within an iframe that is
 not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors④">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑧">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑤">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> expects to be sub-framed within.</p>
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> expects to be sub-framed within.</p>
      </ol>
     <li data-md>
      <p>Let <var>hash</var> be the result of computing a hash over <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑧">clientDataJSON</a></code></code> using SHA-256.</p>
     <li data-md>
      <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑧">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑨">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑨">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a>.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> for this registration,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> for this registration,
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
      <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
     <li id="reg-ceremony-verify-extension-outputs">
      <a class="self-link" href="#reg-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a> can make this
+    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
+    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> and which extensions are in use. 
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Parties</a> MUST be prepared to handle such
+    situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey①">devicePubKey</a> extension has explicit verification procedures, see <a href="#sctn-device-publickey-extension-verification-create">§ 10.2.2.3.1 Registration (create())</a>.</p>
     <li data-md>
@@ -5712,9 +5730,9 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <a class="self-link" href="#reg-ceremony-assess-trust"></a> Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in <a href="#reg-ceremony-verify-attestation">step 21</a>, as follows: 
      <ul>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> policy.</p>
       <li data-md>
        <p>Otherwise, use the X.509 certificates returned as the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path②">attestation trust path</a> from the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑥">verification procedure</a> to verify that the attestation public key either correctly chains up to an acceptable root certificate, or is itself an acceptable certificate
 (i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">Step 22</a> may be the same).</p>
@@ -5722,8 +5740,8 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration ceremony</a>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
     then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
@@ -5735,7 +5753,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-id" id="ref-for-abstract-opdef-credential-record-id①">id</a>
       <dd data-md>
        <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>,
-whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a>.</p>
+whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-publickey" id="ref-for-abstract-opdef-credential-record-publickey">publicKey</a>
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a> in <var>authData</var>.</p>
@@ -5766,22 +5784,22 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      </dl>
     <li data-md>
      <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per <a href="#reg-ceremony-assess-trust">step 23</a> above,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
-     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
-    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> is asserting there
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
+     <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
+    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> is asserting there
     is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a> model.
     See <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol" title="FIDO UAF Protocol Specification v1.0">[UAFProtocol]</a> for a more detailed discussion.</p>
    </ol>
-   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②③">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> has a trusted method of determining acceptable trust anchors
+   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②③">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> has a trusted method of determining acceptable trust anchors
 in <a href="#reg-ceremony-attestation-trust-anchors">step 22</a> above.
-Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> MUST have access to certificate status information for the
-intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
+Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> MUST have access to certificate status information for the
+intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
 provide this chain in the attestation information.</p>
    <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span class="secno">7.2. </span><span class="content">Verifying an Authentication Assertion</span><a class="self-link" href="#sctn-verifying-assertion"></a></h3>
-   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
      <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
@@ -5827,18 +5845,18 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a>. 
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑥">origin</a>. 
     <li data-md>
      <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin⑨">topOrigin</a></code></code> is present:</p>
      <ol>
       <li data-md>
-       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
+       <p>Verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> expects this credential to be used within an iframe that is not <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors⑤">same-origin with its ancestors</a>.</p>
       <li data-md>
        <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①⓪">topOrigin</a></code></code> matches the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⑦">origin</a> of a page
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> expects to be sub-framed within.</p>
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> expects to be sub-framed within.</p>
      </ol>
     <li id="rp-op-verifying-assertion-step-rpid-hash">
-     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a>. 
+     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a>. 
      <p class="note" role="note"><span class="marker">Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
      <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flags</a></code> in <var>authData</var> is set.</p>
@@ -5848,20 +5866,20 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
 verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①④">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flags</a></code> in <var>authData</var> is set.
 Otherwise, ignore the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④④">flag</a>.</p>
     <li data-md>
-     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> business logic or policy,
+     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> business logic or policy,
 let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> bits, respectively,
 of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flags</a></code> in <var>authData</var>.
-Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code> and apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Party</a> policy, if any.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flag</a> values.</p>
+Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code> and apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> policy, if any.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flag</a> values.</p>
     <li id="authn-ceremony-verify-extension-outputs">
      <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client
-    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
-    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> and which extensions are in use. 
-     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Parties</a> MUST be prepared to handle such
-    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> can make this
+    extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
+    In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> and which extensions are in use. 
+     <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Parties</a> MUST be prepared to handle such
+    situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> can make this
     decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> MUST also be
+     <p class="note" role="note"><span class="marker">Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> MUST also be
     prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
      <p class="note" role="note"><span class="marker">Note:</span> The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey②">devicePubKey</a> extension has explicit verification procedures, see <a href="#sctn-device-publickey-extension-verification-get">§ 10.2.2.3.2 Authentication (get())</a>.</p>
     <li data-md>
@@ -5883,13 +5901,13 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
         <dd>This is a signal that
           the authenticator may be cloned, i.e. at least
           two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential private key</a> may exist and are
-          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Parties</a> should incorporate this information
+          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Parties</a> should incorporate this information
           into their risk scoring.
-          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a>-specific. 
+          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-signcount" id="ref-for-abstract-opdef-credential-record-signcount④">signCount</a></code> below in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a>-specific. 
        </dl>
      </ul>
     <li data-md>
-     <p>If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject③">attestationObject</a></code></code> is present and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> wishes to verify the attestation then perform CBOR decoding on <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject④">attestationObject</a></code> to obtain the attestation statement format <var>fmt</var>, and the attestation statement <var>attStmt</var>.</p>
+     <p>If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject③">attestationObject</a></code></code> is present and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> wishes to verify the attestation then perform CBOR decoding on <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject④">attestationObject</a></code> to obtain the attestation statement format <var>fmt</var>, and the attestation statement <var>attStmt</var>.</p>
      <ol>
       <li data-md>
        <p>Verify that the <code>AT</code> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a> field of <var>authData</var> is set, indicating that <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①④">attested credential data</a> is included.</p>
@@ -5919,7 +5937,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
        <p>OPTIONALLY, if <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject⑤">attestationObject</a></code></code> is present,
 update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationobject" id="ref-for-abstract-opdef-credential-record-attestationobject②">attestationObject</a></code> to the value of <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-attestationobject" id="ref-for-dom-authenticatorassertionresponse-attestationobject⑥">attestationObject</a></code></code> and update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-attestationclientdatajson" id="ref-for-abstract-opdef-credential-record-attestationclientdatajson①">attestationClientDataJSON</a></code> to the value of <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①①">clientDataJSON</a></code></code>.</p>
      </ol>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremony</a> steps,
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> performs additional security checks beyond these WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremony</a> steps,
     the above state updates SHOULD be deferred to after those additional checks are completed successfully.</p>
     <li data-md>
      <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>.</p>
@@ -6200,11 +6218,11 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice" title="FIDO Metadata Service">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
-produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
+produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
 the attestation</a> is consistent with the fields of the attestation certificate’s extension data.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
@@ -6277,7 +6295,7 @@ <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirem
    <p>Android Key Attestation <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑧">attestation certificate</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="android key attestation certificate extension data" data-noexport id="android-key-attestation-certificate-extension-data">android key attestation certificate extension
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
 this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⓪">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
@@ -6370,7 +6388,7 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
       <dt data-md>sig
       <dd data-md>
        <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑤">attestation signature</a>.
-The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a> from the authenticator.</p>
+The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> from the authenticator.</p>
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
@@ -6425,7 +6443,7 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
      </ol>
    </dl>
    <h3 class="heading settled" data-level="8.7" id="sctn-none-attestation"><span class="secno">8.7. </span><span class="content">None Attestation Statement Format</span><a class="self-link" href="#sctn-none-attestation"></a></h3>
-   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
+   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
    <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> MAY also directly generate attestation statements of this format
 if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②④">attestation</a>.</p>
    <dl>
@@ -6528,10 +6546,10 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
     <li data-md>
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
-   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
-(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
+   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> can request the use of a set
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
+(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
 processing by the authenticator. <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑤">Authenticator extensions</a> define the following steps and data:</p>
    <ul>
@@ -6549,11 +6567,11 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤①">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤②">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> does not endanger the user’s security or privacy.
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
 that a naïve pass-through that simply transcodes <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension inputs</a> from JSON to CBOR
 will produce a semantically invalid <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑧">authenticator extension input</a> value, resulting in the extension
@@ -6583,18 +6601,18 @@ <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><
 sent via the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑦">authenticatorGetAssertion</a> or <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑦">authenticatorMakeCredential</a> call,
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
-   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> know that the extension was honored by the authenticator. If an
+   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
    <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-parameters"><span class="secno">9.3. </span><span class="content">Extending Request Parameters</span><a class="self-link" href="#sctn-extension-request-parameters"></a></h3>
    <p>An extension defines one or two request arguments. The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-input">client extension input</dfn>,
-which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> to the client
+which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> to the client
 in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
 The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
@@ -6613,8 +6631,8 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 <c- p>});</c->
 </pre>
    <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a>.</p>
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
 authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension
 input</a>,
@@ -6634,7 +6652,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
    <p class="note" role="note"><span class="marker">Note:</span> Extensions should aim to define authenticator arguments that are as small as possible. Some authenticators communicate
     over low-bandwidth links such as Bluetooth Low-Energy or NFC.</p>
    <h3 class="heading settled" data-level="9.4" id="sctn-client-extension-processing"><span class="secno">9.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-processing">Client Extension Processing</dfn></span><a class="self-link" href="#sctn-client-extension-processing"></a></h3>
-   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a> during the creation of credentials or the
+   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> during the creation of credentials or the
 generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a> for the extension is used as an input to this client processing.
 For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①②">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑥">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑧">client extension input</a> as the value.</p>
    <p>Likewise, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑤">client extension outputs</a> are represented as a dictionary in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults④">getClientExtensionResults()</a></code> with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifiers</a> as keys, and the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-output">client extension output</dfn> value of each extension as the value.
@@ -6660,13 +6678,13 @@ <h2 class="heading settled" data-level="10" id="sctn-defined-extensions"><span c
    <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions"><span class="secno">10.1. </span><span class="content">Client Extensions</span><a class="self-link" href="#sctn-defined-client-extensions"></a></h3>
    <p>This section defines extensions that are only <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑦">client extensions</a>.</p>
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
-   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Parties</a> that have previously registered a
+   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑤">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
 order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
      <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> option
@@ -6689,8 +6707,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
 but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a> might be "example.com".</p>
    <dl>
@@ -6717,7 +6735,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
        <p>Let <var>appId</var> be the extension input.</p>
       <li data-md>
        <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid①">determining if a
-caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code>.</p>
+caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
       <li data-md>
        <p>When <a href="#allowCredentialDescriptorListCreation">building allowCredentialDescriptorList</a>,
 if a U2F authenticator indicates that a credential is inapplicable (i.e. by
@@ -6737,9 +6755,9 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑥"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appid"></a></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appid"></a></dfn>;
 };
 </pre>
     <dt data-md>Authenticator extension input
@@ -6753,8 +6771,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
-   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6784,7 +6802,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
         <li data-md>
          <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">determining if a caller’s
 FacetID is authorized for an AppID</a>. If the latter algorithm rejects <var>appId</var> then
-return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
+return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
          <p class="note" role="note"><span class="marker">Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#same-site" id="ref-for-same-site②">same site</a>.</p>
         <li data-md>
          <p>Otherwise, continue with normal processing.</p>
@@ -6829,9 +6847,9 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appidexclude"></a></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appidexclude"></a></dfn>;
 };
 </pre>
     <dt data-md>Authenticator extension input
@@ -6845,7 +6863,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
    <p>At this time, one <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential property</a> is defined: the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property①">resident key credential property</a> (i.e., <a data-link-type="dfn" href="#credentialpropertiesoutput-client-side-discoverable-credential-property" id="ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a>).</p>
    <dl>
     <dt data-md>Extension identifier
@@ -6856,9 +6874,9 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-credprops"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-credprops"></a></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
@@ -6868,7 +6886,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
     <dd data-md>
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑥">Set</a> <code><a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults①">clientExtensionResults</a>["<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>"]["rk"]</code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①"><c- g>rk</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①"><c- g>rk</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑦"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
@@ -6877,14 +6895,14 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①">boolean</a></span>
        <dd data-md>
         <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn> (i.e., <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</dfn>),
-is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
+is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension input
@@ -6898,11 +6916,11 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
    <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
    <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
    <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> is identical.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6940,7 +6958,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>”.</p>
       <li data-md>
        <p>Set <code>hmac-secret</code> to <code>true</code> in the authenticator extensions input.</p>
       <li data-md>
@@ -6957,15 +6975,15 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
        <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results">results</a></code> to the decrypted PRF result(s), if any.</p>
      </ol>
    </dl>
-   <p class="note" role="note"><span class="marker">Note:</span> If PRF results are obtained during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⓪">registration</a> then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> MUST inspect the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a> of the response in order to determine the correct value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification⑤">userVerification</a></code> for future <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertions</a>. Otherwise results from <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertions</a> may be inconsistent with those from the <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> If PRF results are obtained during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⓪">registration</a> then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> MUST inspect the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a> of the response in order to determine the correct value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification⑤">userVerification</a></code> for future <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertions</a>. Otherwise results from <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertions</a> may be inconsistent with those from the <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>.</p>
    <dl>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
       <li data-md>
-       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
+       <p>If any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is the empty string, or is not a valid <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a>, or does not equal the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⑤">id</a></code> of some element of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> after performing <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">base64url decoding</a>, then return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#syntaxerror" id="ref-for-syntaxerror">SyntaxError</a></code>”.</p>
       <li data-md>
        <p>Initialize the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-prf" id="ref-for-dom-authenticationextensionsclientoutputs-prf">prf</a></code> extension output to an empty dictionary.</p>
       <li data-md>
@@ -6991,11 +7009,11 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </ol>
     <dt data-md>Authenticator extension input / processing / output
     <dd data-md>
-     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled②"><c- g>enabled</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①②"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled②"><c- g>enabled</c-></a>;
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues④"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues " href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results②"><c- g>results</c-></a>;
 };
 
@@ -7005,7 +7023,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-enabled"><code>enabled</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①②">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-enabled"><code>enabled</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①③">boolean</a></span>
        <dd data-md>
         <p><code>true</code> if, and only if, the one or two PRFs are available for use with the created credential. This is only reported during <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and is not present in the case of <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①④">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-results"><code>results</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues⑤">AuthenticationExtensionsPRFValues</a></span>
@@ -7015,12 +7033,12 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </div>
    </dl>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob">large, per-credential blobs</a>.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credentials</a>,
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credentials</a>,
 and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤">required</a></code>.
 However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credentials</a>.</p>
    <dl>
@@ -7043,7 +7061,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargeblobinputs"><code><c- g>AuthenticationExtensionsLargeBlobInputs</c-></code></dfn> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥③"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①③"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
     <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①④"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource " href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
 };
 </pre>
@@ -7052,12 +7070,12 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥④">DOMString</a></span>
        <dd data-md>
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
@@ -7067,7 +7085,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read①">read</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write①">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support①">support</a></code> is present and has the value <code class="idl"><a data-link-type="idl" href="#dom-largeblobsupport-required" id="ref-for-dom-largeblobsupport-required">required</a></code>:</p>
@@ -7096,13 +7114,13 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support③">support</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If both <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read②">read</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write②">write</a></code> are present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read③">read</a></code> is present and has the value <code>true</code>:</p>
@@ -7122,7 +7140,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
          <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> does not contain exactly one element:</p>
          <ol>
           <li data-md>
-           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
+           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
          </ol>
         <li data-md>
          <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a>, associated with the indicated credential.</p>
@@ -7137,27 +7155,27 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargebloboutputs"><code><c- g>AuthenticationExtensionsLargeBlobOutputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported②"><c- g>supported</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑥"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported②"><c- g>supported</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③⓪"><c- b>ArrayBuffer</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="ArrayBuffer " href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob②"><c- g>blob</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑥"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written①"><c- g>written</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑦"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written①"><c- g>written</c-></a>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-supported"><code>supported</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑦">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-supported"><code>supported</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑧">boolean</a></span>
        <dd data-md>
         <p><code>true</code> if, and only if, the created credential supports storing large blobs. Only present in <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⓪">registration</a> outputs.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-blob"><code>blob</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③①">ArrayBuffer</a></span>
        <dd data-md>
         <p>The opaque byte string that was associated with the credential identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid⑤">rawId</a></code>. Only valid if <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read④">read</a></code> was <code>true</code>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑧">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑨">boolean</a></span>
        <dd data-md>
         <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>, associated with the specified credential.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Parties</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
@@ -7172,9 +7190,9 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">Authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑨"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-uvm"></a></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②⓪"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-uvm"></a></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
@@ -7252,19 +7270,19 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
 </pre>
    </dl>
    <h4 class="heading settled" data-level="10.2.2" id="sctn-device-publickey-extension"><span class="secno">10.2.2. </span><span class="content">Device-bound public key extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="devicepubkey">devicePubKey</dfn>)</span><a class="self-link" href="#sctn-device-publickey-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a> with a "device continuity" signal for <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials. This is done by creating a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>-specific <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair②">hardware-bound device key pair</a> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, if such a key pair does not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credential</a> being created or exercised, and returning the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key">device public key</a> along with a signature by the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key①">device private key</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey③">devicePubKey</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
+   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> with a "device continuity" signal for <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials. This is done by creating a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>-specific <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair②">hardware-bound device key pair</a> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a>, if such a key pair does not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credential</a> being created or exercised, and returning the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key">device public key</a> along with a signature by the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key①">device private key</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey③">devicePubKey</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
    <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> is incapable of generating a <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair③">hardware-bound device key pair</a>, or the registration or authentication operation fails for any reason, this extension is ignored and no <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair④">hardware-bound device key pair</a> is created. In this case, there is no <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey④">devicePubKey</a> extension output generated.</p>
    <p>The <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑤">hardware-bound device key pair</a> is not on its own a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a> and does not have its own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a>. Instead, the returned <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①">device public key</a> is a device-specific contextual attribute of its associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credential</a> is used—along with the <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑤">devicePubKey</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a>, a particular <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key②">device public key</a> is returned by the extension, along with a signature demonstrating proof-of-possession of the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key②">device private key</a> by that device.</p>
    <h5 class="heading settled" data-level="10.2.2.1" id="sctn-device-publickey-extension-usage"><span class="secno">10.2.2.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-device-publickey-extension-usage"></a></h5>
-   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension provides a "device continuity" signal <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations:</p>
-   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> uses the <code>devicePubKey</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>, a signature by a new <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①">device-bound key</a> ("dpk 1") is returned along with the new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key③">device public key</a>. Even if the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>, "dpk 1" never leaves the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator⑤">generating authenticator</a> ("authenticator 1"). The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations using the same user credential with that <i>same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a></i> generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertions</a> including further signatures by the <i>same</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key②">device-bound key</a> ("dpk 1"). This behavior on "authenticator 1" is independent of whether this user credential has been copied to any other <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a>.</p>
-   <p>Then, if this same user credential is copied to a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> ("authenticator 2"), the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a>'s first <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> call on "authenticator 2" (that includes the <code>devicePubKey</code> extension) will produce an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①④">assertion</a> including a signature by a <i>new</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key③">device-bound key</a> ("dpk 2"). Note that such a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a> can be exercised on "authenticator 2" without a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">create()</a></code> having been performed on "authenticator 2". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> calls on "authenticator 2", using the <code>devicePubKey</code> extension and the same user credential, yield further signatures by "dpk 2".</p>
+   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension provides a "device continuity" signal <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations:</p>
+   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> uses the <code>devicePubKey</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>, a signature by a new <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①">device-bound key</a> ("dpk 1") is returned along with the new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key③">device public key</a>. Even if the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>, "dpk 1" never leaves the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator⑤">generating authenticator</a> ("authenticator 1"). The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations using the same user credential with that <i>same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a></i> generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertions</a> including further signatures by the <i>same</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key②">device-bound key</a> ("dpk 1"). This behavior on "authenticator 1" is independent of whether this user credential has been copied to any other <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a>.</p>
+   <p>Then, if this same user credential is copied to a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> ("authenticator 2"), the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a>'s first <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> call on "authenticator 2" (that includes the <code>devicePubKey</code> extension) will produce an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①④">assertion</a> including a signature by a <i>new</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key③">device-bound key</a> ("dpk 2"). Note that such a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a> can be exercised on "authenticator 2" without a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">create()</a></code> having been performed on "authenticator 2". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> calls on "authenticator 2", using the <code>devicePubKey</code> extension and the same user credential, yield further signatures by "dpk 2".</p>
    <p>A usage example is thus:</p>
    <blockquote>
     <p>Say that a sign-in request appears at a website along with some geolocation signal that has not been seen for this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a> before, and is outside of the typical usage hours observed for the account. The risk may be deemed high enough not to allow the request, even with an assertion by a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑧">multi-device credential</a> on its own. But if a signature by a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key④">device-bound key</a> that is <i>well established</i> for this user can also be presented, then that may tip the balance.</p>
    </blockquote>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Parties</a> need to take care to verify <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑤">device-bound key</a> signatures before associating and storing extension output value fields in conjunction with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a>. See <a href="#sctn-device-publickey-extension-verification">§ 10.2.2.3 devicePubKey Extension Output Verification Procedures</a>.</p>
-   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a> give to the presence of a signature from a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑥">device-bound key</a> may be based on information learned from its optional attestation. An attestation can indicate the level of protection that the hardware offers the private key, certifications for the hardware, etc.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a> need to take care to verify <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑤">device-bound key</a> signatures before associating and storing extension output value fields in conjunction with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a>. See <a href="#sctn-device-publickey-extension-verification">§ 10.2.2.3 devicePubKey Extension Output Verification Procedures</a>.</p>
+   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Parties</a> give to the presence of a signature from a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑥">device-bound key</a> may be based on information learned from its optional attestation. An attestation can indicate the level of protection that the hardware offers the private key, certifications for the hardware, etc.</p>
    <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-extension-definition"><span class="secno">10.2.2.2. </span><span class="content">Extension Definition</span><a class="self-link" href="#sctn-device-publickey-extension-definition"></a></h5>
    <dl>
     <dt data-md>Extension identifier
@@ -7288,12 +7306,12 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsdevicepublickeyinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑦">DOMString</a>, defaulting to <code>"none"</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance⑤">attestation conveyance</a>.
-Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑤">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance⑤">attestation conveyance</a>.
+Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑤">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
         <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑦">none</a></code>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsdevicepublickeyinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥⑧">DOMString</a>>, defaulting to <code>[]</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
 This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
@@ -7334,7 +7352,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
 )
 
 attObjForDevicePublicKey = { ; Note: This object conveys an attested
-                             ; device public key and is analogous to `attObj`.
+                             ; device public key and is analogous to \`attObj\`.
 
     aaguid:  bstr,  ; Authenticator’s AAGUID (16 bytes fixed-length)
                     ; https://www.w3.org/TR/webauthn/#aaguid
@@ -7367,18 +7385,18 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
 
     ; See https://www.w3.org/TR/webauthn/#sctn-generating-an-attestation-object
     ;
-    ; Attestation statement formats define the `fmt` and `attStmt` members of
+    ; Attestation statement formats define the \`fmt\` and \`attStmt\` members of
     ; $$attStmtType.
-    ; Note that `fmt` and `attStmt` are top-level members of
-    ; `attObjForDevicePublicKey`.
+    ; Note that \`fmt\` and \`attStmt\` are top-level members of
+    ; \`attObjForDevicePublicKey\`.
     ;
-    ; In summary, the `attStmt` will (typically) contain:
+    ; In summary, the \`attStmt\` will (typically) contain:
     ;   (1) a SIGNATURE value calculated (using the attestation private key)
-    ;       over (prefix || aaguid || dpk || nonce) where `prefix` is
+    ;       over (prefix || aaguid || dpk || nonce) where \`prefix\` is
     ;       h’64657669636520626f756e64206b6579206174746573746174696f6e20736967
     ;         00ffffffff'.
     ;       (See the attestation calculations section, below, for a discussion
-    ;       about the purpose of this `prefix` value.)
+    ;       about the purpose of this \`prefix\` value.)
     ;   (2) the attestation certificate or public key, and supporting certificates,
     ;       if any.
     ;
@@ -7390,7 +7408,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
 
     ; An optional boolean that indicates whether the attestation statement
     ; contains uniquely identifying information. This can only be true
-    ; when the `attestation` field of the extension input is "enterprise"
+    ; when the \`attestation\` field of the extension input is "enterprise"
     ; and either the user-agent or the authenticator permits uniquely
     ; identifying attestation for the requested RP ID.
 
@@ -7422,7 +7440,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
          <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①⓪">AAGUID</a>. (Since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑦">hardware-bound device key pair</a> is specific to a particular authenticator, its attestation can be tied to hardware roots of trust, although they do not have to be. This is in contrast to the associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credential</a>'s attestation, if it is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①⓪">multi-device credential</a>.)</p>
         <dt data-md>enterprise
         <dd data-md>
-         <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then <var>attFormat</var> is "none" and <var>attAaguid</var> is 16 zero bytes. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑥">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①①">AAGUID</a>. (Again, since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑧">hardware-bound device key pair</a> is specific to a particular authenticator, the attestation may be tied to hardware roots of trust.)</p>
+         <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then <var>attFormat</var> is "none" and <var>attAaguid</var> is 16 zero bytes. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑥">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①①">AAGUID</a>. (Again, since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑧">hardware-bound device key pair</a> is specific to a particular authenticator, the attestation may be tied to hardware roots of trust.)</p>
          <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticators</a>.</p>
        </dl>
       <li data-md>
@@ -7452,7 +7470,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
        </ol>
       <li data-md>
        <p>Let <var>dpkSig</var> be the result of signing the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①⓪">assertion signature</a> <a href="#fig-signature">input</a> with <var>devicePrivateKey</var>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>dpkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a> knows that <var>dpkSig</var> is a fresh signature.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>dpkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> knows that <var>dpkSig</var> is a fresh signature.</p>
       <li data-md>
        <p>Output <var>dpkSig</var> as the extension’s <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑦">unsigned extension output</a>.</p>
        <p class="note" role="note"><span class="marker">Note:</span> <var>dpkSig</var> cannot be included in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑧">authenticator extension output</a> because it is returned inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> and that would imply that the signature signs over itself.</p>
@@ -7461,7 +7479,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
    <h6 class="heading settled" data-level="10.2.2.2.1" id="sctn-device-publickey-attestation-aaguid"><span class="secno">10.2.2.2.1. </span><span class="content">AAGUIDs</span><a class="self-link" href="#sctn-device-publickey-attestation-aaguid"></a></h6>
    <p>The <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①②">AAGUID</a> included in the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑥">devicePubKey</a></code> extension output, if non-zero, identifies the make or model of hardware that is storing the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑨">device-bound key</a>. This is distinct from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①③">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑧">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①②">multi-device credential</a>, which likely identifies something broader since such credentials are not bound to a single device. Thus the two AAGUIDs MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
    <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-device-publickey-attestation-calculations"><span class="secno">10.2.2.2.2. </span><span class="content">Attestation calculations</span><a class="self-link" href="#sctn-device-publickey-attestation-calculations"></a></h6>
-   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⓪">device-bound key</a>, the typical value for <code>hash</code> hashes over the attestation signature itself, which is impossible. Also the attestation of a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①①">device-bound key</a> is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
+   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⓪">device-bound key</a>, the typical value for <code>hash</code> hashes over the attestation signature itself, which is impossible. Also the attestation of a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①①">device-bound key</a> is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
    <p>Therefore when calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①②">device-bound key</a>, the inputs are:</p>
    <ul>
     <li data-md>
@@ -7472,7 +7490,7 @@ <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-device-publickey-at
    <p>The attestation signature is thus typically calculated over the bytes of <code>(h’64657669636520626f756e64206b6579206174746573746174696f6e2073696700ffffffff' || <var>aaguid</var> || <var>dpk</var> || <var>nonce</var>)</code>. The 37-byte prefix ensures domain separation: it takes the place of the RP ID hash, flags, and signature counter fields in those messages and ensures that no attestation signature for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①③">device-bound key</a> can be confused with a signature for a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>.</p>
    <p>Note that when <var>nonce</var> is empty, then the (signed) authenticator extension output MAY be constant. However, the (unsigned) <var>dpkSig</var> output is always unique and prevents replay of the (signed) extension output without knowledge of the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key④">device private key</a>.</p>
    <h5 class="heading settled" data-level="10.2.2.3" id="sctn-device-publickey-extension-verification"><span class="secno">10.2.2.3. </span><span class="content"><code>devicePubKey</code> Extension Output Verification Procedures</span><a class="self-link" href="#sctn-device-publickey-extension-verification"></a></h5>
-   <p>Verifying the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑦">devicePubKey</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a> whenever a <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑥">device public key</a> is returned within the extension output.</p>
+   <p>Verifying the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑦">devicePubKey</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a> whenever a <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑥">device public key</a> is returned within the extension output.</p>
    <p>The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑧">devicePubKey</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential records</a>:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-devicepubkeys">devicePubKeys</dfn>
@@ -7500,8 +7518,8 @@ <h5 class="heading settled" data-level="10.2.2.3" id="sctn-device-publickey-exte
      </dl>
    </dl>
    <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-extension-verification-create"><span class="secno">10.2.2.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-device-publickey-extension-verification-create"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code> call,
-then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code> call,
+then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientoutputs-devicepubkey">devicePubKey</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature">signature</a></code> field.</p>
@@ -7513,7 +7531,7 @@ <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-ex
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature①">signature</a></code> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑦">device public key</a> <var>dpk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a>.)</p>
     <li data-md>
-     <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑨">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+     <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑨">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
      <p class="note" role="note"><span class="marker">Note:</span> If <var>fmt</var>’s value is "<a data-link-type="dfn" href="#none" id="ref-for-none⑧">none</a>" there is no attestation signature to verify.</p>
     <li data-md>
      <p>Create a new <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record①">device-bound key record</a> with the contents:</p>
@@ -7539,8 +7557,8 @@ <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-ex
    </ol>
    <p>See also <a href="#sctn-device-publickey-extension-usage">§ 10.2.2.1 Relying Party Usage</a> for further details.</p>
    <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-extension-verification-get"><span class="secno">10.2.2.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-device-publickey-extension-verification-get"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> call,
-then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 17</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> call,
+then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 17</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientoutputs-devicepubkey①">devicePubKey</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature②">signature</a></code> field.</p>
@@ -7580,7 +7598,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
          <p class="note" role="note"><span class="marker">Note:</span> This authenticator is not generating a fresh per-response random nonce.</p>
         <dt data-md>does not equal <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-attstmt" id="ref-for-abstract-opdef-devicepubkey-record-attstmt②">attStmt</a> by binary equality:
         <dd data-md>
-         <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③⓪">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+         <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③⓪">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
          <p>If the result is:</p>
          <dl class="switch">
           <dt data-md>successful
@@ -7610,10 +7628,10 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
          <dl class="switch">
           <dt data-md>If <var>fmt</var>’s value is "none":
           <dd data-md>
-           <p>There is no attestation signature to verify and this is a new device. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-device-bound-key-record" id="ref-for-abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</a> and then terminate these verification steps.</p>
+           <p>There is no attestation signature to verify and this is a new device. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-device-bound-key-record" id="ref-for-abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</a> and then terminate these verification steps.</p>
           <dt data-md>Otherwise:
           <dd data-md>
-           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
            <p>If the result is:</p>
            <dl class="switch">
             <dt data-md>successful
@@ -7625,7 +7643,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
            </dl>
          </dl>
         <li data-md>
-         <p>Otherwise there is some form of error: we recieved a known <var>dpk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> has stored along with that <var>dpk</var> value. Terminate these verification steps.</p>
+         <p>Otherwise there is some form of error: we recieved a known <var>dpk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> has stored along with that <var>dpk</var> value. Terminate these verification steps.</p>
        </ol>
      </dl>
    </ol>
@@ -7749,8 +7767,8 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
      <p>The protocol the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑥">Virtual Authenticator</a> speaks: one of <code>"ctap1/u2f"</code>, <code>"ctap2"</code> or <code>"ctap2_1"</code> <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.</p>
     <dt data-md><var>transport</var>
     <dd data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑤">AuthenticatorTransport</a></code> simulated. If the <var>transport</var> is set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal②">internal</a></code>, the
-authenticator simulates <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment④">platform attachment</a>. Otherwise, it simulates <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attachment</a>.</p>
+     <p>The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑦">AuthenticatorTransport</a></code> simulated. If the <var>transport</var> is set to <code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal③">internal</a></code>, the
+authenticator simulates <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment⑤">platform attachment</a>. Otherwise, it simulates <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑥">cross-platform attachment</a>.</p>
     <dt data-md><var>hasResidentKey</var>
     <dd data-md>
      <p>If set to <code>true</code> the authenticator will support <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑥">client-side discoverable credentials</a>.</p>
@@ -7807,7 +7825,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
       <tr>
        <td><var>transport</var>
        <td>string
-       <td><code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑥">AuthenticatorTransport</a></code> values
+       <td><code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport⑧">AuthenticatorTransport</a></code> values
        <td>None
       <tr>
        <td><var>hasResidentKey</var>
@@ -8192,14 +8210,14 @@ <h3 class="heading settled" data-level="12.1" id="sctn-att-fmt-reg-update"><span
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: android-key</p>
     <li data-md>
-     <p>Description: <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">Platform authenticators</a> on versions "N", and later, may provide this proprietary "hardware
+     <p>Description: <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">Platform authenticators</a> on versions "N", and later, may provide this proprietary "hardware
 attestation" statement.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-android-key-attestation">§ 8.4 Android Key Attestation Statement Format</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: android-safetynet</p>
     <li data-md>
-     <p>Description: Android-based <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑧">platform authenticators</a> MAY produce an attestation statement based on the Android
+     <p>Description: Android-based <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticators</a> MAY produce an attestation statement based on the Android
 SafetyNet API.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-android-safetynet-attestation">§ 8.5 Android SafetyNet Attestation Statement Format</a> of this specification <br><br></p>
@@ -8216,13 +8234,13 @@ <h3 class="heading settled" data-level="12.2" id="sctn-att-fmt-reg"><span class=
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: apple</p>
     <li data-md>
-     <p>Description: Used with Apple devices' <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑨">platform authenticators</a></p>
+     <p>Description: Used with Apple devices' <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑦">platform authenticators</a></p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-apple-anonymous-attestation">§ 8.8 Apple Anonymous Attestation Statement Format</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: none</p>
     <li data-md>
-     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
+     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> of this specification</p>
    </ul>
@@ -8232,7 +8250,7 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
@@ -8240,7 +8258,7 @@ <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><s
      <p>WebAuthn Extension Identifier: uvm</p>
     <li data-md>
      <p>Description: This <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②②">authentication extension</a> enables use of a user verification method.
-The user verification method extension returns to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> which user verification methods (factors) were
+The user verification method extension returns to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a> which user verification methods (factors) were
 used for the WebAuthn operation.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-uvm-extension">§ 10.2.1 User Verification Method Extension (uvm)</a> of this specification</p>
@@ -8251,60 +8269,60 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: appidExclude</p>
     <li data-md>
-     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
+     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-appid-exclude-extension">§ 10.1.2 FIDO AppID Exclusion Extension (appidExclude)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
      <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑤">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
    <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><span class="secno">13. </span><span class="content">Security Considerations</span><a class="self-link" href="#sctn-security-considerations"></a></h2>
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
-The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
-The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Parties</a> as to their provenance.</p>
+The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
+The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Party</a>'s
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
 Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> is not signed.
 This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> returns
-the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑤">assertion</a>), and thus the interaction would end in an error.</p>
+the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑨">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑤">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
-   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a>.
+   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a>.
 This arrangement has some important advantages.</p>
-   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
-For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming authenticator</a> can communicate only via USB or Bluetooth,
+   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑤">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑥">authentication factor</a>.
+For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticator</a> can communicate only via USB or Bluetooth,
 the limited range of these transports ensures that any malicious actor
 must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>.
 This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> that can be invoked remotely —
 even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
 users can be tricked into authorizing remotely initiated malicious requests.</p>
-   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
-By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> is mediated by some third party,
-then the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> has to trust the third party to
+   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
+By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> is mediated by some third party,
+then the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> has to trust the third party to
 enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> for other users.</p>
-   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a>,
-or where <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> do not communicate directly,
+   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a>,
+or where <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a> do not communicate directly,
 designers SHOULD consider how this affects the enforcement of <a data-link-type="dfn" href="#scope" id="ref-for-scope②②">scope</a> restrictions
 and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⑦">something you have</a> authentication factor.</p>
    <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
@@ -8317,44 +8335,44 @@ <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span c
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
    <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> manufacturer that
 has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
-intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Parties</a> MUST update their trusted root certificates
+intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
    <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①②">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">private key</a> has been compromised. A WebAuthn
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
 manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
 scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
-   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Parties</a> by this specification include:</p>
+   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> can optionally
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> can optionally
 enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticators</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
 Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
 methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
 to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge④">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
    <p>In order to prevent replay attacks, the challenges MUST contain enough entropy to make guessing them infeasible. Challenges SHOULD
@@ -8362,144 +8380,144 @@ <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenge
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
    <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤②">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> qualities.
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a> qualities.
 For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
 However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑤">attestation object</a> was generated
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑤">attestation object</a> was generated
 by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑥">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
    <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> maintains
 confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
-   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a>: unscathed
+   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> reports
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a> reports
 a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> also
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a> also
 un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> that were registered
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a> in order to un-register
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a> in order to un-register
 related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> was performed after revocation of such certificates.</p>
    <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
    <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticators</a>.
 In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
 different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code> argument risks leaking information
 about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
 For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a>,
 and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a>.
 The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑥">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
-which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Parties</a>.</p>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
 but is not an exhaustive list.</p>
    <ul>
     <li data-md>
-     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a>,
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a>,
 either intentionally or due to a security vulnerability in the third party.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
 and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a>.</p>
     <li data-md>
      <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a>.
 For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> <code>example.org</code>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
 malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> and impersonate the victims of the attack.</p>
-     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
    </ul>
    <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><span class="secno">14. </span><span class="content">Privacy Considerations</span><a class="self-link" href="#sctn-privacy-considerations"></a></h2>
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
-   <p>Many aspects of the design of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a> are motivated by privacy concerns. The main concern considered in
+   <p>Many aspects of the design of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> are motivated by privacy concerns. The main concern considered in
 this specification is the protection of the user’s personal identity, i.e., the identification of a human being or a correlation
-of separate identities as belonging to the same human being. Although the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑦">Web Authentication API</a> does not use or provide any
+of separate identities as belonging to the same human being. Although the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑧">Web Authentication API</a> does not use or provide any
 form of global identity, the following kinds of potentially correlatable identifiers are used:</p>
    <ul>
     <li data-md>
      <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
-     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
-private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>.</p>
+     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
+private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> depending on the implementation.</p>
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a>, but in
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑧">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> depending on the implementation.</p>
     <li data-md>
      <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>.</p>
     <li data-md>
      <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a>.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
-   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Parties</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> to enable strong
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Parties</a>.</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑥">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Parties</a> thus cannot correlate users between their
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②③">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Parties</a>.</p>
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
-authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑧">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑧">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑦">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a>.</p>
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑨">platform
+authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a>, depending on the implementation. Biometric data is
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑧">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑧">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑦">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a>.</p>
    <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
@@ -8526,81 +8544,81 @@ <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><s
     confusion in the specific context of this specification.</p>
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②②">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">clients</a> outside what’s defined by this specification, e.g.,
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①①①">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication
 ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②③">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> has been
 performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②④">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑤">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑥">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥①">user verification</a> SHOULD NOT store personally identifying information.</p>
    <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
    <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑦">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑧">authenticator</a>'s enrolled user(s).</p>
-   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①①">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
+   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①②">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⑨">authenticator</a>:</p>
    <ul>
     <li data-md>
      <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⓪">authenticators</a> are present.</p>
     <li data-md>
      <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③①">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③②">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Party</a> could identify the user by probing for
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
 timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code>:</p>
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> could identify the user by probing
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
 failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> parameter is
 available to the user.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
-   <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform
+   <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
 and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a>, since hashing does not prevent probing for guessable input
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> responds with a failure, but then
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> might leak sensitive
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> responds with a failure, but then
 successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> may implement to mitigate or prevent information
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
      <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
@@ -8620,7 +8638,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
 ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑥">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①⑤">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
     are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> member could therefore be populated with pseudo-random values
@@ -8637,17 +8655,17 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④②">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Parties</a>,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a>,
 but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a>,
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Parties</a>,
 so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
 given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> could for example:</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
@@ -8659,11 +8677,11 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
    </ul>
    <p>If the above prevention measures are not available,
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑧">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑨">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④⓪">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑨">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> MAY adjust the timeout accordingly.</p>
    <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span class="secno">16. </span><span class="content">Acknowledgements</span><a class="self-link" href="#sctn-acknowledgements"></a></h2>
     We thank the following people for their reviews of, and contributions to, this specification:
 Yuriy Ackermann,
@@ -8720,7 +8738,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     allowCredentials
     <ul>
      <li><a href="#dom-publickeycredentialrequestoptions-allowcredentials">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-     <li><a href="#dom-publickeycredentialrequestoptionsjson-allowcredentials">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-allowcredentials">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#android-key-attestation-certificate-extension-data">android key attestation certificate extension data</a><span>, in § 8.4.1</span>
    <li><a href="#anonca">AnonCA</a><span>, in § 6.5.4</span>
@@ -8749,7 +8767,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#dom-authenticationextensionsdevicepublickeyinputs-attestation">dict-member for AuthenticationExtensionsDevicePublicKeyInputs</a><span>, in § 10.2.2.2</span>
      <li><a href="#dom-publickeycredentialcreationoptions-attestation">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-attestation">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-attestation">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrequestoptions-attestation">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
     </ul>
    <li><a href="#attestation-ca">Attestation CA</a><span>, in § 6.5.4</span>
@@ -8792,7 +8810,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#authentication-ceremony">Authentication Ceremony</a><span>, in § 4</span>
    <li><a href="#authentication-extension">authentication extension</a><span>, in § 9</span>
    <li><a href="#dictdef-authenticationextensionsclientinputs">AuthenticationExtensionsClientInputs</a><span>, in § 5.7.1</span>
-   <li><a href="#dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a><span>, in § 5.1.8</span>
+   <li><a href="#dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a><span>, in § 5.1.9</span>
    <li><a href="#dictdef-authenticationextensionsclientoutputs">AuthenticationExtensionsClientOutputs</a><span>, in § 5.7.2</span>
    <li><a href="#dictdef-authenticationextensionsclientoutputsjson">AuthenticationExtensionsClientOutputsJSON</a><span>, in § 5.1</span>
    <li><a href="#dictdef-authenticationextensionsdevicepublickeyinputs">AuthenticationExtensionsDevicePublicKeyInputs</a><span>, in § 10.2.2.2</span>
@@ -8847,7 +8865,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     authenticatorSelection
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-authenticatorselection">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-authenticatorselection">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-authenticatorselection">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#dictdef-authenticatorselectioncriteria">AuthenticatorSelectionCriteria</a><span>, in § 5.4.4</span>
    <li><a href="#authenticator-session">authenticator session</a><span>, in § 6.3</span>
@@ -8883,9 +8901,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#dom-collectedclientdata-challenge">dict-member for CollectedClientData</a><span>, in § 5.8.1</span>
      <li><a href="#dom-publickeycredentialcreationoptions-challenge">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-challenge">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-challenge">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrequestoptions-challenge">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-     <li><a href="#dom-publickeycredentialrequestoptionsjson-challenge">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-challenge">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#client">Client</a><span>, in § 4</span>
    <li><a href="#client-data">client data</a><span>, in § 5.8.1</span>
@@ -8993,7 +9011,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     displayName
     <ul>
      <li><a href="#dom-publickeycredentialuserentity-displayname">dict-member for PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
-     <li><a href="#dom-publickeycredentialuserentityjson-displayname">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialuserentityjson-displayname">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#abstract-opdef-devicepubkey-record-dpk">dpk</a><span>, in § 10.2.2.3</span>
    <li><a href="#authdata-flags-ed">ED</a><span>, in § 6.1</span>
@@ -9009,7 +9027,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     excludeCredentials
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-excludecredentials">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-excludecredentials">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-excludecredentials">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#extension-identifier">extension identifier</a><span>, in § 9.1</span>
    <li>
@@ -9017,9 +9035,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#authdata-extensions">dfn for authData</a><span>, in § 6.1</span>
      <li><a href="#dom-publickeycredentialcreationoptions-extensions">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-extensions">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-extensions">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrequestoptions-extensions">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-     <li><a href="#dom-publickeycredentialrequestoptionsjson-extensions">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-extensions">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#dom-authenticationextensionsprfvalues-first">first</a><span>, in § 10.1.4</span>
    <li><a href="#first-factor-roaming-authenticator">First-factor roaming authenticator</a><span>, in § 6.2</span>
@@ -9045,10 +9063,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#public-key-credential-source-id">dfn for public key credential source</a><span>, in § 4</span>
      <li><a href="#dom-authenticationresponsejson-id">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-publickeycredentialdescriptor-id">dict-member for PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
-     <li><a href="#dom-publickeycredentialdescriptorjson-id">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialdescriptorjson-id">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrpentity-id">dict-member for PublicKeyCredentialRpEntity</a><span>, in § 5.4.2</span>
      <li><a href="#dom-publickeycredentialuserentity-id">dict-member for PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
-     <li><a href="#dom-publickeycredentialuserentityjson-id">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialuserentityjson-id">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-registrationresponsejson-id">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-tokenbinding-id">dict-member for TokenBinding</a><span>, in § 5.8.1</span>
     </ul>
@@ -9058,6 +9076,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-authenticatortransport-internal">"internal"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-internal">internal</a><span>, in § 5.8.4</span>
    <li><a href="#dom-publickeycredential-isconditionalmediationavailable">isConditionalMediationAvailable()</a><span>, in § 5.1</span>
+   <li><a href="#dom-publickeycredential-ispasskeyplatformauthenticatoravailable">isPasskeyPlatformAuthenticatorAvailable()</a><span>, in § 5.1.8</span>
    <li><a href="#publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</a><span>, in § 5.1.4.2</span>
    <li><a href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable()</a><span>, in § 5.1.7</span>
    <li><a href="#collectedclientdata-json-compatible-serialization-of-client-data">JSON-compatible serialization of client data</a><span>, in § 5.8.1</span>
@@ -9078,7 +9097,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     name
     <ul>
      <li><a href="#dom-publickeycredentialentity-name">dict-member for PublicKeyCredentialEntity</a><span>, in § 5.4.1</span>
-     <li><a href="#dom-publickeycredentialuserentityjson-name">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialuserentityjson-name">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#dom-authenticatortransport-nfc">"nfc"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-nfc">nfc</a><span>, in § 5.8.4</span>
@@ -9094,8 +9113,10 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#discoverablecredentialmetadata-otherui">dfn for DiscoverableCredentialMetadata</a><span>, in § 6.3.5</span>
      <li><a href="#public-key-credential-source-otherui">dfn for public key credential source</a><span>, in § 4</span>
     </ul>
-   <li><a href="#dom-publickeycredential-parsecreationoptionsfromjson">parseCreationOptionsFromJSON(options)</a><span>, in § 5.1.8</span>
-   <li><a href="#dom-publickeycredential-parserequestoptionsfromjson">parseRequestOptionsFromJSON(options)</a><span>, in § 5.1.9</span>
+   <li><a href="#dom-publickeycredential-parsecreationoptionsfromjson">parseCreationOptionsFromJSON(options)</a><span>, in § 5.1.9</span>
+   <li><a href="#dom-publickeycredential-parserequestoptionsfromjson">parseRequestOptionsFromJSON(options)</a><span>, in § 5.1.10</span>
+   <li><a href="#passkey">Passkey</a><span>, in § 4</span>
+   <li><a href="#passkey-platform-authenticator">Passkey platform authenticator</a><span>, in § 6.2</span>
    <li><a href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an authenticator data structure</a><span>, in § 6.1</span>
    <li><a href="#dom-authenticatorattachment-platform">"platform"</a><span>, in § 5.4.5</span>
    <li><a href="#dom-authenticatorattachment-platform">platform</a><span>, in § 5.4.5</span>
@@ -9130,7 +9151,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     pubKeyCredParams
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-pubkeycredparams">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-pubkeycredparams">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-pubkeycredparams">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#dom-publickeycredentialtype-public-key">"public-key"</a><span>, in § 5.8.2</span>
    <li><a href="#dom-publickeycredentialtype-public-key">public-key</a><span>, in § 5.8.2</span>
@@ -9146,21 +9167,21 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#public-key-credential">Public Key Credential</a><span>, in § 4</span>
    <li><a href="#publickeycredential">PublicKeyCredential</a><span>, in § 5.1</span>
    <li><a href="#dictdef-publickeycredentialcreationoptions">PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-   <li><a href="#dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+   <li><a href="#dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
    <li><a href="#dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
-   <li><a href="#dictdef-publickeycredentialdescriptorjson">PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
+   <li><a href="#dictdef-publickeycredentialdescriptorjson">PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.9</span>
    <li><a href="#dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a><span>, in § 5.4.1</span>
    <li><a href="#typedefdef-publickeycredentialjson">PublicKeyCredentialJSON</a><span>, in § 5.1</span>
    <li><a href="#dictdef-publickeycredentialparameters">PublicKeyCredentialParameters</a><span>, in § 5.3</span>
    <li><a href="#dictdef-publickeycredentialrequestoptions">PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-   <li><a href="#dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+   <li><a href="#dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
    <li><a href="#dictdef-publickeycredentialrpentity">PublicKeyCredentialRpEntity</a><span>, in § 5.4.2</span>
    <li><a href="#publickey-credentials-create-feature">publickey-credentials-create-feature</a><span>, in § 5.9</span>
    <li><a href="#publickey-credentials-get-feature">publickey-credentials-get-feature</a><span>, in § 5.9</span>
    <li><a href="#public-key-credential-source">Public Key Credential Source</a><span>, in § 4</span>
    <li><a href="#enumdef-publickeycredentialtype">PublicKeyCredentialType</a><span>, in § 5.8.2</span>
    <li><a href="#dictdef-publickeycredentialuserentity">PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
-   <li><a href="#dictdef-publickeycredentialuserentityjson">PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+   <li><a href="#dictdef-publickeycredentialuserentityjson">PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.9</span>
    <li><a href="#rate-limiting">Rate Limiting</a><span>, in § 4</span>
    <li>
     rawId
@@ -9213,7 +9234,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     rp
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-rp">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-rp">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-rp">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#rp-id">RP ID</a><span>, in § 4</span>
    <li>
@@ -9221,7 +9242,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#public-key-credential-source-rpid">dfn for public key credential source</a><span>, in § 4</span>
      <li><a href="#dom-publickeycredentialrequestoptions-rpid">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-     <li><a href="#dom-publickeycredentialrequestoptionsjson-rpid">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-rpid">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#authdata-rpidhash">rpIdHash</a><span>, in § 6.1</span>
    <li>
@@ -9276,9 +9297,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     timeout
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-timeout">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-timeout">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-timeout">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialrequestoptions-timeout">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-     <li><a href="#dom-publickeycredentialrequestoptionsjson-timeout">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-timeout">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#dom-publickeycredential-tojson">toJSON()</a><span>, in § 5.1</span>
    <li><a href="#dictdef-tokenbinding">TokenBinding</a><span>, in § 5.8.1</span>
@@ -9292,7 +9313,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#abstract-opdef-credential-record-transports">abstract-op for credential record</a><span>, in § 4</span>
      <li><a href="#dom-authenticatorattestationresponsejson-transports">dict-member for AuthenticatorAttestationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-publickeycredentialdescriptor-transports">dict-member for PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
-     <li><a href="#dom-publickeycredentialdescriptorjson-transports">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialdescriptorjson-transports">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#dom-publickeycredential-type-slot">[[type]]</a><span>, in § 5.1</span>
    <li>
@@ -9304,7 +9325,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
      <li><a href="#dom-authenticationresponsejson-type">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-collectedclientdata-type">dict-member for CollectedClientData</a><span>, in § 5.8.1</span>
      <li><a href="#dom-publickeycredentialdescriptor-type">dict-member for PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
-     <li><a href="#dom-publickeycredentialdescriptorjson-type">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialdescriptorjson-type">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.9</span>
      <li><a href="#dom-publickeycredentialparameters-type">dict-member for PublicKeyCredentialParameters</a><span>, in § 5.3</span>
      <li><a href="#dom-registrationresponsejson-type">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
     </ul>
@@ -9317,7 +9338,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     user
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-user">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
-     <li><a href="#dom-publickeycredentialcreationoptionsjson-user">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-user">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#user-account">User Account</a><span>, in § 4</span>
    <li><a href="#user-consent">User Consent</a><span>, in § 4</span>
@@ -9339,7 +9360,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#dom-authenticatorselectioncriteria-userverification">dict-member for AuthenticatorSelectionCriteria</a><span>, in § 5.4.4</span>
      <li><a href="#dom-publickeycredentialrequestoptions-userverification">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
-     <li><a href="#dom-publickeycredentialrequestoptionsjson-userverification">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-userverification">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.10</span>
     </ul>
    <li><a href="#user-verification-method">User Verification Method</a><span>, in § 10.2.1</span>
    <li><a href="#enumdef-userverificationrequirement">UserVerificationRequirement</a><span>, in § 5.8.6</span>
@@ -9896,6 +9917,10 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>> <a href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></a>();
 };
 
+<c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>> <a href="#dom-publickeycredential-ispasskeyplatformauthenticatoravailable"><code><c- g>isPasskeyPlatformAuthenticatorAvailable</c-></code></a>();
+};
+
 <c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential"><c- g>PublicKeyCredential</c-></a> {
     <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions"><c- n>PublicKeyCredentialCreationOptions</c-></a> <a href="#dom-publickeycredential-parsecreationoptionsfromjson"><code><c- g>parseCreationOptionsFromJSON</c-></code></a>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptionsjson"><c- n>PublicKeyCredentialCreationOptionsJSON</c-></a> <a href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options"><code><c- g>options</c-></code></a>);
 };
@@ -10775,10 +10800,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['ad09952f'] = {"dfnID": "ad09952f", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot", "dfnText": "[[discovery]]", "refSections": [{"refs": [{"id": "ref-for-dom-credential-discovery-slot"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
 window.dfnpanelData['f41069dd'] = {"dfnID": "f41069dd", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot", "dfnText": "[[type]]", "refSections": [{"refs": [{"id": "ref-for-dom-credential-type-slot"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
 window.dfnpanelData['f9c635f5'] = {"dfnID": "f9c635f5", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional", "dfnText": "conditional", "refSections": [{"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2461"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2462"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2463"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2465"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2466"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2467"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2468"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u24ea"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2460"}, {"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-credentialmediationrequirement-conditional\u2460\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": true};
-window.dfnpanelData['b0f5bc03'] = {"dfnID": "b0f5bc03", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create", "dfnText": "create()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-create"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462"}, {"id": "ref-for-dom-credentialscontainer-create\u2463"}, {"id": "ref-for-dom-credentialscontainer-create\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2465"}], "title": "5.1.1. CredentialCreationOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2462"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2463"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2467"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2468"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2462"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2464"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2466"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2466"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2463\u24ea"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2461"}], "title": "11.6. Get Credentials"}], "external": true};
+window.dfnpanelData['b0f5bc03'] = {"dfnID": "b0f5bc03", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create", "dfnText": "create()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-create"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462"}, {"id": "ref-for-dom-credentialscontainer-create\u2463"}, {"id": "ref-for-dom-credentialscontainer-create\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2465"}], "title": "5.1.1. CredentialCreationOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2462"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2463"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-create\u2460\u2467"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2460\u2468"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u24ea"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2461\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2462"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2464"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2466"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2467"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2461\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u24ea"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2460"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2464"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2466"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2462\u2467"}, {"id": "ref-for-dom-credentialscontainer-create\u2462\u2468"}, {"id": "ref-for-dom-credentialscontainer-create\u2463\u24ea"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-create\u2463\u2461"}], "title": "11.6. Get Credentials"}], "external": true};
 window.dfnpanelData['736ad5f8'] = {"dfnID": "736ad5f8", "url": "https://w3c.github.io/webappsec-credential-management/#concept-credential", "dfnText": "credential", "refSections": [{"refs": [{"id": "ref-for-concept-credential"}, {"id": "ref-for-concept-credential\u2460"}, {"id": "ref-for-concept-credential\u2461"}, {"id": "ref-for-concept-credential\u2462"}, {"id": "ref-for-concept-credential\u2463"}, {"id": "ref-for-concept-credential\u2464"}, {"id": "ref-for-concept-credential\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-credential\u2466"}, {"id": "ref-for-concept-credential\u2467"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-concept-credential\u2468"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u24ea"}, {"id": "ref-for-concept-credential\u2460\u2460"}, {"id": "ref-for-concept-credential\u2460\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2463"}, {"id": "ref-for-concept-credential\u2460\u2464"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2466"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-concept-credential\u2460\u2468"}, {"id": "ref-for-concept-credential\u2461\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2460"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2461"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2462"}, {"id": "ref-for-concept-credential\u2461\u2463"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2464"}, {"id": "ref-for-concept-credential\u2461\u2465"}], "title": "14.4.1. Attestation Privacy"}, {"refs": [{"id": "ref-for-concept-credential\u2461\u2466"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": true};
 window.dfnpanelData['944c2033'] = {"dfnID": "944c2033", "url": "https://w3c.github.io/webappsec-credential-management/#credential-source", "dfnText": "credential source", "refSections": [{"refs": [{"id": "ref-for-credential-source"}], "title": "4. Terminology"}], "external": true};
-window.dfnpanelData['99134679'] = {"dfnID": "99134679", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get", "dfnText": "get()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-get"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2464"}, {"id": "ref-for-dom-credentialscontainer-get\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2468"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2461"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2468"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u24ea"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2464"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2465"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2467"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2468"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u24ea"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2466"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2468"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2462"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2464"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2465"}], "title": "14.6.2. Username Enumeration"}], "external": true};
+window.dfnpanelData['99134679'] = {"dfnID": "99134679", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get", "dfnText": "get()", "refSections": [{"refs": [{"id": "ref-for-dom-credentialscontainer-get"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2464"}, {"id": "ref-for-dom-credentialscontainer-get\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2468"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2461"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2464"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2466"}, {"id": "ref-for-dom-credentialscontainer-get\u2460\u2467"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2460\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u24ea"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2463"}, {"id": "ref-for-dom-credentialscontainer-get\u2461\u2464"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2465"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2466"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2467"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2461\u2468"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u24ea"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2462"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2465"}, {"id": "ref-for-dom-credentialscontainer-get\u2462\u2466"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2462\u2468"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u24ea"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2460"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2461"}, {"id": "ref-for-dom-credentialscontainer-get\u2463\u2462"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2464"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-dom-credentialscontainer-get\u2463\u2465"}], "title": "14.6.2. Username Enumeration"}], "external": true};
 window.dfnpanelData['cbdd0aff'] = {"dfnID": "cbdd0aff", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-credential-id"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credential-id\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-credential-id\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": true};
 window.dfnpanelData['546b09a7'] = {"dfnID": "546b09a7", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation", "dfnText": "mediation", "refSections": [{"refs": [{"id": "ref-for-dom-credentialrequestoptions-mediation"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-credentialrequestoptions-mediation\u2460"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-dom-credentialrequestoptions-mediation\u2461"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2462"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2463"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2464"}, {"id": "ref-for-dom-credentialrequestoptions-mediation\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['d0140610'] = {"dfnID": "d0140610", "url": "https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote", "dfnText": "remote", "refSections": [{"refs": [{"id": "ref-for-dom-credential-discovery-remote"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
@@ -10815,11 +10840,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['7b91cdaa'] = {"dfnID": "7b91cdaa", "url": "https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success", "dfnText": "section 5.4", "refSections": [{"refs": [{"id": "ref-for-authentication-response-message-success"}], "title": "6.1.2. FIDO U2F Signature Format Compatibility"}], "external": true};
 window.dfnpanelData['ea2e2fcc'] = {"dfnID": "ea2e2fcc", "url": "https://w3c.github.io/FileAPI/#blob-url-entry-object", "dfnText": "object", "refSections": [{"refs": [{"id": "ref-for-blob-url-entry-object"}, {"id": "ref-for-blob-url-entry-object\u2460"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-blob-url-entry-object\u2461"}, {"id": "ref-for-blob-url-entry-object\u2462"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-blob-url-entry-object\u2463"}], "title": "11.6. Get Credentials"}, {"refs": [{"id": "ref-for-blob-url-entry-object\u2464"}], "title": "11.9. Set User Verified"}], "external": true};
 window.dfnpanelData['57435598'] = {"dfnID": "57435598", "url": "https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow", "dfnText": "allow", "refSections": [{"refs": [{"id": "ref-for-attr-iframe-allow"}, {"id": "ref-for-attr-iframe-allow\u2460"}], "title": "5.10. Using Web Authentication within iframe elements"}], "external": true};
-window.dfnpanelData['3610bd67'] = {"dfnID": "3610bd67", "url": "https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use", "dfnText": "allowed to use", "refSections": [{"refs": [{"id": "ref-for-allowed-to-use"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-allowed-to-use\u2460"}, {"id": "ref-for-allowed-to-use\u2461"}], "title": "5.9. Permissions Policy integration"}], "external": true};
+window.dfnpanelData['3610bd67'] = {"dfnID": "3610bd67", "url": "https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use", "dfnText": "allowed to use", "refSections": [{"refs": [{"id": "ref-for-allowed-to-use"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-allowed-to-use\u2460"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-allowed-to-use\u2461"}, {"id": "ref-for-allowed-to-use\u2462"}], "title": "5.9. Permissions Policy integration"}], "external": true};
 window.dfnpanelData['b410a6ef'] = {"dfnID": "b410a6ef", "url": "https://html.spec.whatwg.org/multipage/browsers.html#ascii-serialisation-of-an-origin", "dfnText": "ascii serialization of an origin", "refSections": [{"refs": [{"id": "ref-for-ascii-serialisation-of-an-origin"}, {"id": "ref-for-ascii-serialisation-of-an-origin\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-ascii-serialisation-of-an-origin\u2461"}, {"id": "ref-for-ascii-serialisation-of-an-origin\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['9d07aa9a'] = {"dfnID": "9d07aa9a", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete", "dfnText": "autocomplete", "refSections": [{"refs": [{"id": "ref-for-attr-fe-autocomplete"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['19a777c9'] = {"dfnID": "19a777c9", "url": "https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens", "dfnText": "autofill detail token", "refSections": [{"refs": [{"id": "ref-for-autofill-detail-tokens"}, {"id": "ref-for-autofill-detail-tokens\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
-window.dfnpanelData['faf954d6'] = {"dfnID": "faf954d6", "url": "https://html.spec.whatwg.org/multipage/browsers.html#browsing-context", "dfnText": "browsing context", "refSections": [{"refs": [{"id": "ref-for-browsing-context"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-browsing-context\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}], "external": true};
+window.dfnpanelData['faf954d6'] = {"dfnID": "faf954d6", "url": "https://html.spec.whatwg.org/multipage/browsers.html#browsing-context", "dfnText": "browsing context", "refSections": [{"refs": [{"id": "ref-for-browsing-context"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-browsing-context\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-browsing-context\u2461"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}], "external": true};
 window.dfnpanelData['aca22383'] = {"dfnID": "aca22383", "url": "https://html.spec.whatwg.org/multipage/interaction.html#consume-user-activation", "dfnText": "consume user activation", "refSections": [{"refs": [{"id": "ref-for-consume-user-activation"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['12b8dfc0'] = {"dfnID": "12b8dfc0", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object", "dfnText": "current settings object", "refSections": [{"refs": [{"id": "ref-for-current-settings-object"}], "title": "5.9. Permissions Policy integration"}], "external": true};
 window.dfnpanelData['87478abb'] = {"dfnID": "87478abb", "url": "https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain", "dfnText": "document.domain", "refSections": [{"refs": [{"id": "ref-for-dom-document-domain"}], "title": "4. Terminology"}], "external": true};
@@ -10834,7 +10859,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['e0660c76'] = {"dfnID": "e0660c76", "url": "https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque", "dfnText": "opaque origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin-opaque"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-concept-origin-opaque\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-origin-opaque\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['a944ac4c'] = {"dfnID": "a944ac4c", "url": "https://html.spec.whatwg.org/multipage/origin.html#concept-origin", "dfnText": "origin", "refSections": [{"refs": [{"id": "ref-for-concept-origin"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-concept-origin\u2460"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-concept-origin\u2461"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-concept-origin\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-origin\u2463"}, {"id": "ref-for-concept-origin\u2464"}, {"id": "ref-for-concept-origin\u2465"}, {"id": "ref-for-concept-origin\u2466"}, {"id": "ref-for-concept-origin\u2467"}, {"id": "ref-for-concept-origin\u2468"}, {"id": "ref-for-concept-origin\u2460\u24ea"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2462"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2463"}, {"id": "ref-for-concept-origin\u2460\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2465"}, {"id": "ref-for-concept-origin\u2460\u2466"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2467"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-concept-origin\u2460\u2468"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
 window.dfnpanelData['43ac8374'] = {"dfnID": "43ac8374", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin", "dfnText": "origin (for environment settings object)", "refSections": [{"refs": [{"id": "ref-for-concept-settings-object-origin"}, {"id": "ref-for-concept-settings-object-origin\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2461"}, {"id": "ref-for-concept-settings-object-origin\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2463"}, {"id": "ref-for-concept-settings-object-origin\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-concept-settings-object-origin\u2466"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": true};
-window.dfnpanelData['a41102eb'] = {"dfnID": "a41102eb", "url": "https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy", "dfnText": "permissions policy", "refSections": [{"refs": [{"id": "ref-for-concept-document-permissions-policy"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2461"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2462"}], "title": "5.9. Permissions Policy integration"}], "external": true};
+window.dfnpanelData['a41102eb'] = {"dfnID": "a41102eb", "url": "https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy", "dfnText": "permissions policy", "refSections": [{"refs": [{"id": "ref-for-concept-document-permissions-policy"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2461"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2462"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-concept-document-permissions-policy\u2463"}], "title": "5.9. Permissions Policy integration"}], "external": true};
 window.dfnpanelData['e99bd18e'] = {"dfnID": "e99bd18e", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#concept-relevant-global", "dfnText": "relevant global object", "refSections": [{"refs": [{"id": "ref-for-concept-relevant-global"}, {"id": "ref-for-concept-relevant-global\u2460"}, {"id": "ref-for-concept-relevant-global\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['9c4c1e66'] = {"dfnID": "9c4c1e66", "url": "https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object", "dfnText": "relevant settings object", "refSections": [{"refs": [{"id": "ref-for-relevant-settings-object"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-relevant-settings-object\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relevant-settings-object\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relevant-settings-object\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relevant-settings-object\u2463"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": true};
 window.dfnpanelData['feac4ab3'] = {"dfnID": "feac4ab3", "url": "https://html.spec.whatwg.org/multipage/browsers.html#same-site", "dfnText": "same site", "refSections": [{"refs": [{"id": "ref-for-same-site"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-same-site\u2460"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-same-site\u2461"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
@@ -10925,14 +10950,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['2f8afbfe'] = {"dfnID": "2f8afbfe", "url": "https://webidl.spec.whatwg.org/#idl-ArrayBuffer", "dfnText": "ArrayBuffer", "refSections": [{"refs": [{"id": "ref-for-idl-ArrayBuffer"}, {"id": "ref-for-idl-ArrayBuffer\u2460"}, {"id": "ref-for-idl-ArrayBuffer\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2465"}, {"id": "ref-for-idl-ArrayBuffer\u2466"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2468"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u24ea"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2460"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2460\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2465"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2460\u2466"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2460\u2468"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u24ea"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2461\u2460"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2461\u2461"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2462"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2463"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2464"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2465"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2466"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2467"}, {"id": "ref-for-idl-ArrayBuffer\u2461\u2468"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2462\u24ea"}, {"id": "ref-for-idl-ArrayBuffer\u2462\u2460"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-ArrayBuffer\u2462\u2461"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
 window.dfnpanelData['3aff2fb3'] = {"dfnID": "3aff2fb3", "url": "https://webidl.spec.whatwg.org/#BufferSource", "dfnText": "BufferSource", "refSections": [{"refs": [{"id": "ref-for-BufferSource"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-BufferSource\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-BufferSource\u2461"}, {"id": "ref-for-BufferSource\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-BufferSource\u2463"}, {"id": "ref-for-BufferSource\u2464"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-BufferSource\u2465"}, {"id": "ref-for-BufferSource\u2466"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-BufferSource\u2467"}, {"id": "ref-for-BufferSource\u2468"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-BufferSource\u2460\u24ea"}, {"id": "ref-for-BufferSource\u2460\u2460"}, {"id": "ref-for-BufferSource\u2460\u2461"}, {"id": "ref-for-BufferSource\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-BufferSource\u2460\u2463"}, {"id": "ref-for-BufferSource\u2460\u2464"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
 window.dfnpanelData['48c6127a'] = {"dfnID": "48c6127a", "url": "https://webidl.spec.whatwg.org/#constrainterror", "dfnText": "ConstraintError", "refSections": [{"refs": [{"id": "ref-for-constrainterror"}, {"id": "ref-for-constrainterror\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": true};
-window.dfnpanelData['dca2de17'] = {"dfnID": "dca2de17", "url": "https://webidl.spec.whatwg.org/#idl-DOMException", "dfnText": "DOMException", "refSections": [{"refs": [{"id": "ref-for-idl-DOMException"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460"}, {"id": "ref-for-idl-DOMException\u2461"}, {"id": "ref-for-idl-DOMException\u2462"}, {"id": "ref-for-idl-DOMException\u2463"}, {"id": "ref-for-idl-DOMException\u2464"}, {"id": "ref-for-idl-DOMException\u2465"}, {"id": "ref-for-idl-DOMException\u2466"}, {"id": "ref-for-idl-DOMException\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2468"}, {"id": "ref-for-idl-DOMException\u2460\u24ea"}, {"id": "ref-for-idl-DOMException\u2460\u2460"}, {"id": "ref-for-idl-DOMException\u2460\u2461"}, {"id": "ref-for-idl-DOMException\u2460\u2462"}, {"id": "ref-for-idl-DOMException\u2460\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2464"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2465"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2466"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2467"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2468"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u24ea"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2460"}, {"id": "ref-for-idl-DOMException\u2461\u2461"}, {"id": "ref-for-idl-DOMException\u2461\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2463"}, {"id": "ref-for-idl-DOMException\u2461\u2464"}, {"id": "ref-for-idl-DOMException\u2461\u2465"}, {"id": "ref-for-idl-DOMException\u2461\u2466"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
-window.dfnpanelData['8855a9aa'] = {"dfnID": "8855a9aa", "url": "https://webidl.spec.whatwg.org/#idl-DOMString", "dfnText": "DOMString", "refSections": [{"refs": [{"id": "ref-for-idl-DOMString"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460"}, {"id": "ref-for-idl-DOMString\u2461"}, {"id": "ref-for-idl-DOMString\u2462"}, {"id": "ref-for-idl-DOMString\u2463"}, {"id": "ref-for-idl-DOMString\u2464"}, {"id": "ref-for-idl-DOMString\u2465"}, {"id": "ref-for-idl-DOMString\u2466"}, {"id": "ref-for-idl-DOMString\u2467"}, {"id": "ref-for-idl-DOMString\u2468"}, {"id": "ref-for-idl-DOMString\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2461"}, {"id": "ref-for-idl-DOMString\u2460\u2462"}, {"id": "ref-for-idl-DOMString\u2460\u2463"}, {"id": "ref-for-idl-DOMString\u2460\u2464"}, {"id": "ref-for-idl-DOMString\u2460\u2465"}, {"id": "ref-for-idl-DOMString\u2460\u2466"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2467"}, {"id": "ref-for-idl-DOMString\u2460\u2468"}, {"id": "ref-for-idl-DOMString\u2461\u24ea"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2460"}, {"id": "ref-for-idl-DOMString\u2461\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2462"}, {"id": "ref-for-idl-DOMString\u2461\u2463"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2464"}, {"id": "ref-for-idl-DOMString\u2461\u2465"}, {"id": "ref-for-idl-DOMString\u2461\u2466"}, {"id": "ref-for-idl-DOMString\u2461\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2468"}, {"id": "ref-for-idl-DOMString\u2462\u24ea"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2460"}, {"id": "ref-for-idl-DOMString\u2462\u2461"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2462"}, {"id": "ref-for-idl-DOMString\u2462\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2464"}, {"id": "ref-for-idl-DOMString\u2462\u2465"}, {"id": "ref-for-idl-DOMString\u2462\u2466"}, {"id": "ref-for-idl-DOMString\u2462\u2467"}, {"id": "ref-for-idl-DOMString\u2462\u2468"}, {"id": "ref-for-idl-DOMString\u2463\u24ea"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2460"}, {"id": "ref-for-idl-DOMString\u2463\u2461"}, {"id": "ref-for-idl-DOMString\u2463\u2462"}, {"id": "ref-for-idl-DOMString\u2463\u2463"}, {"id": "ref-for-idl-DOMString\u2463\u2464"}, {"id": "ref-for-idl-DOMString\u2463\u2465"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2466"}, {"id": "ref-for-idl-DOMString\u2463\u2467"}, {"id": "ref-for-idl-DOMString\u2463\u2468"}, {"id": "ref-for-idl-DOMString\u2464\u24ea"}, {"id": "ref-for-idl-DOMString\u2464\u2460"}, {"id": "ref-for-idl-DOMString\u2464\u2461"}, {"id": "ref-for-idl-DOMString\u2464\u2462"}, {"id": "ref-for-idl-DOMString\u2464\u2463"}, {"id": "ref-for-idl-DOMString\u2464\u2464"}, {"id": "ref-for-idl-DOMString\u2464\u2465"}, {"id": "ref-for-idl-DOMString\u2464\u2466"}, {"id": "ref-for-idl-DOMString\u2464\u2467"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2464\u2468"}, {"id": "ref-for-idl-DOMString\u2465\u24ea"}, {"id": "ref-for-idl-DOMString\u2465\u2460"}, {"id": "ref-for-idl-DOMString\u2465\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2465\u2462"}, {"id": "ref-for-idl-DOMString\u2465\u2463"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2465\u2464"}, {"id": "ref-for-idl-DOMString\u2465\u2465"}, {"id": "ref-for-idl-DOMString\u2465\u2466"}, {"id": "ref-for-idl-DOMString\u2465\u2467"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
-window.dfnpanelData['9befea0b'] = {"dfnID": "9befea0b", "url": "https://webidl.spec.whatwg.org/#encodingerror", "dfnText": "EncodingError", "refSections": [{"refs": [{"id": "ref-for-encodingerror"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-encodingerror\u2460"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
+window.dfnpanelData['dca2de17'] = {"dfnID": "dca2de17", "url": "https://webidl.spec.whatwg.org/#idl-DOMException", "dfnText": "DOMException", "refSections": [{"refs": [{"id": "ref-for-idl-DOMException"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460"}, {"id": "ref-for-idl-DOMException\u2461"}, {"id": "ref-for-idl-DOMException\u2462"}, {"id": "ref-for-idl-DOMException\u2463"}, {"id": "ref-for-idl-DOMException\u2464"}, {"id": "ref-for-idl-DOMException\u2465"}, {"id": "ref-for-idl-DOMException\u2466"}, {"id": "ref-for-idl-DOMException\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2468"}, {"id": "ref-for-idl-DOMException\u2460\u24ea"}, {"id": "ref-for-idl-DOMException\u2460\u2460"}, {"id": "ref-for-idl-DOMException\u2460\u2461"}, {"id": "ref-for-idl-DOMException\u2460\u2462"}, {"id": "ref-for-idl-DOMException\u2460\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2464"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2465"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2466"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2467"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMException\u2460\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u24ea"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2460"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2461"}, {"id": "ref-for-idl-DOMException\u2461\u2462"}, {"id": "ref-for-idl-DOMException\u2461\u2463"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-idl-DOMException\u2461\u2464"}, {"id": "ref-for-idl-DOMException\u2461\u2465"}, {"id": "ref-for-idl-DOMException\u2461\u2466"}, {"id": "ref-for-idl-DOMException\u2461\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
+window.dfnpanelData['8855a9aa'] = {"dfnID": "8855a9aa", "url": "https://webidl.spec.whatwg.org/#idl-DOMString", "dfnText": "DOMString", "refSections": [{"refs": [{"id": "ref-for-idl-DOMString"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460"}, {"id": "ref-for-idl-DOMString\u2461"}, {"id": "ref-for-idl-DOMString\u2462"}, {"id": "ref-for-idl-DOMString\u2463"}, {"id": "ref-for-idl-DOMString\u2464"}, {"id": "ref-for-idl-DOMString\u2465"}, {"id": "ref-for-idl-DOMString\u2466"}, {"id": "ref-for-idl-DOMString\u2467"}, {"id": "ref-for-idl-DOMString\u2468"}, {"id": "ref-for-idl-DOMString\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2461"}, {"id": "ref-for-idl-DOMString\u2460\u2462"}, {"id": "ref-for-idl-DOMString\u2460\u2463"}, {"id": "ref-for-idl-DOMString\u2460\u2464"}, {"id": "ref-for-idl-DOMString\u2460\u2465"}, {"id": "ref-for-idl-DOMString\u2460\u2466"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-DOMString\u2460\u2467"}, {"id": "ref-for-idl-DOMString\u2460\u2468"}, {"id": "ref-for-idl-DOMString\u2461\u24ea"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2460"}, {"id": "ref-for-idl-DOMString\u2461\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2462"}, {"id": "ref-for-idl-DOMString\u2461\u2463"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2464"}, {"id": "ref-for-idl-DOMString\u2461\u2465"}, {"id": "ref-for-idl-DOMString\u2461\u2466"}, {"id": "ref-for-idl-DOMString\u2461\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2461\u2468"}, {"id": "ref-for-idl-DOMString\u2462\u24ea"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2460"}, {"id": "ref-for-idl-DOMString\u2462\u2461"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2462"}, {"id": "ref-for-idl-DOMString\u2462\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2462\u2464"}, {"id": "ref-for-idl-DOMString\u2462\u2465"}, {"id": "ref-for-idl-DOMString\u2462\u2466"}, {"id": "ref-for-idl-DOMString\u2462\u2467"}, {"id": "ref-for-idl-DOMString\u2462\u2468"}, {"id": "ref-for-idl-DOMString\u2463\u24ea"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2460"}, {"id": "ref-for-idl-DOMString\u2463\u2461"}, {"id": "ref-for-idl-DOMString\u2463\u2462"}, {"id": "ref-for-idl-DOMString\u2463\u2463"}, {"id": "ref-for-idl-DOMString\u2463\u2464"}, {"id": "ref-for-idl-DOMString\u2463\u2465"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2463\u2466"}, {"id": "ref-for-idl-DOMString\u2463\u2467"}, {"id": "ref-for-idl-DOMString\u2463\u2468"}, {"id": "ref-for-idl-DOMString\u2464\u24ea"}, {"id": "ref-for-idl-DOMString\u2464\u2460"}, {"id": "ref-for-idl-DOMString\u2464\u2461"}, {"id": "ref-for-idl-DOMString\u2464\u2462"}, {"id": "ref-for-idl-DOMString\u2464\u2463"}, {"id": "ref-for-idl-DOMString\u2464\u2464"}, {"id": "ref-for-idl-DOMString\u2464\u2465"}, {"id": "ref-for-idl-DOMString\u2464\u2466"}, {"id": "ref-for-idl-DOMString\u2464\u2467"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2464\u2468"}, {"id": "ref-for-idl-DOMString\u2465\u24ea"}, {"id": "ref-for-idl-DOMString\u2465\u2460"}, {"id": "ref-for-idl-DOMString\u2465\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2465\u2462"}, {"id": "ref-for-idl-DOMString\u2465\u2463"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-DOMString\u2465\u2464"}, {"id": "ref-for-idl-DOMString\u2465\u2465"}, {"id": "ref-for-idl-DOMString\u2465\u2466"}, {"id": "ref-for-idl-DOMString\u2465\u2467"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
+window.dfnpanelData['9befea0b'] = {"dfnID": "9befea0b", "url": "https://webidl.spec.whatwg.org/#encodingerror", "dfnText": "EncodingError", "refSections": [{"refs": [{"id": "ref-for-encodingerror"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-encodingerror\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
 window.dfnpanelData['889e932f'] = {"dfnID": "889e932f", "url": "https://webidl.spec.whatwg.org/#Exposed", "dfnText": "Exposed", "refSections": [{"refs": [{"id": "ref-for-Exposed"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-Exposed\u2460"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-Exposed\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-Exposed\u2462"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
 window.dfnpanelData['797018a7'] = {"dfnID": "797018a7", "url": "https://webidl.spec.whatwg.org/#invalidstateerror", "dfnText": "InvalidStateError", "refSections": [{"refs": [{"id": "ref-for-invalidstateerror"}, {"id": "ref-for-invalidstateerror\u2460"}, {"id": "ref-for-invalidstateerror\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-invalidstateerror\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-invalidstateerror\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-invalidstateerror\u2464"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
-window.dfnpanelData['ba556545'] = {"dfnID": "ba556545", "url": "https://webidl.spec.whatwg.org/#notallowederror", "dfnText": "NotAllowedError", "refSections": [{"refs": [{"id": "ref-for-notallowederror"}, {"id": "ref-for-notallowederror\u2460"}, {"id": "ref-for-notallowederror\u2461"}, {"id": "ref-for-notallowederror\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notallowederror\u2463"}, {"id": "ref-for-notallowederror\u2464"}, {"id": "ref-for-notallowederror\u2465"}, {"id": "ref-for-notallowederror\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notallowederror\u2467"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-notallowederror\u2468"}, {"id": "ref-for-notallowederror\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-notallowederror\u2460\u2460"}, {"id": "ref-for-notallowederror\u2460\u2461"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": true};
+window.dfnpanelData['ba556545'] = {"dfnID": "ba556545", "url": "https://webidl.spec.whatwg.org/#notallowederror", "dfnText": "NotAllowedError", "refSections": [{"refs": [{"id": "ref-for-notallowederror"}, {"id": "ref-for-notallowederror\u2460"}, {"id": "ref-for-notallowederror\u2461"}, {"id": "ref-for-notallowederror\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notallowederror\u2463"}, {"id": "ref-for-notallowederror\u2464"}, {"id": "ref-for-notallowederror\u2465"}, {"id": "ref-for-notallowederror\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notallowederror\u2467"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-notallowederror\u2468"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-notallowederror\u2460\u24ea"}, {"id": "ref-for-notallowederror\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-notallowederror\u2460\u2461"}, {"id": "ref-for-notallowederror\u2460\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": true};
 window.dfnpanelData['3182eb71'] = {"dfnID": "3182eb71", "url": "https://webidl.spec.whatwg.org/#notsupportederror", "dfnText": "NotSupportedError", "refSections": [{"refs": [{"id": "ref-for-notsupportederror"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notsupportederror\u2460"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-notsupportederror\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-notsupportederror\u2462"}, {"id": "ref-for-notsupportederror\u2463"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-notsupportederror\u2464"}, {"id": "ref-for-notsupportederror\u2465"}, {"id": "ref-for-notsupportederror\u2466"}, {"id": "ref-for-notsupportederror\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": true};
-window.dfnpanelData['bdbd19d1'] = {"dfnID": "bdbd19d1", "url": "https://webidl.spec.whatwg.org/#idl-promise", "dfnText": "Promise", "refSections": [{"refs": [{"id": "ref-for-idl-promise"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-idl-promise\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-promise\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2463"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}], "external": true};
+window.dfnpanelData['bdbd19d1'] = {"dfnID": "bdbd19d1", "url": "https://webidl.spec.whatwg.org/#idl-promise", "dfnText": "Promise", "refSections": [{"refs": [{"id": "ref-for-idl-promise"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-idl-promise\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-promise\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2463"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-idl-promise\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-promise\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}], "external": true};
 window.dfnpanelData['a5c91173'] = {"dfnID": "a5c91173", "url": "https://webidl.spec.whatwg.org/#SameObject", "dfnText": "SameObject", "refSections": [{"refs": [{"id": "ref-for-SameObject"}, {"id": "ref-for-SameObject\u2460"}, {"id": "ref-for-SameObject\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-SameObject\u2462"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-SameObject\u2463"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-SameObject\u2464"}, {"id": "ref-for-SameObject\u2465"}, {"id": "ref-for-SameObject\u2466"}, {"id": "ref-for-SameObject\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
 window.dfnpanelData['b75bb3bd'] = {"dfnID": "b75bb3bd", "url": "https://webidl.spec.whatwg.org/#SecureContext", "dfnText": "SecureContext", "refSections": [{"refs": [{"id": "ref-for-SecureContext"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-SecureContext\u2460"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-SecureContext\u2461"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-SecureContext\u2462"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": true};
 window.dfnpanelData['c3e881ef'] = {"dfnID": "c3e881ef", "url": "https://webidl.spec.whatwg.org/#securityerror", "dfnText": "SecurityError", "refSections": [{"refs": [{"id": "ref-for-securityerror"}, {"id": "ref-for-securityerror\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-securityerror\u2461"}, {"id": "ref-for-securityerror\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-securityerror\u2463"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-securityerror\u2464"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}], "external": true};
@@ -10940,18 +10965,18 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['82ca3efc'] = {"dfnID": "82ca3efc", "url": "https://webidl.spec.whatwg.org/#exceptiondef-typeerror", "dfnText": "TypeError", "refSections": [{"refs": [{"id": "ref-for-exceptiondef-typeerror"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['b0d7f3c3'] = {"dfnID": "b0d7f3c3", "url": "https://webidl.spec.whatwg.org/#idl-USVString", "dfnText": "USVString", "refSections": [{"refs": [{"id": "ref-for-idl-USVString"}, {"id": "ref-for-idl-USVString\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-USVString\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-USVString\u2462"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-USVString\u2463"}, {"id": "ref-for-idl-USVString\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['81dd847b'] = {"dfnID": "81dd847b", "url": "https://webidl.spec.whatwg.org/#unknownerror", "dfnText": "UnknownError", "refSections": [{"refs": [{"id": "ref-for-unknownerror"}, {"id": "ref-for-unknownerror\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-unknownerror\u2461"}, {"id": "ref-for-unknownerror\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": true};
-window.dfnpanelData['5372cca8'] = {"dfnID": "5372cca8", "url": "https://webidl.spec.whatwg.org/#idl-boolean", "dfnText": "boolean", "refSections": [{"refs": [{"id": "ref-for-idl-boolean"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-boolean\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-boolean\u2461"}, {"id": "ref-for-idl-boolean\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-boolean\u2463"}, {"id": "ref-for-idl-boolean\u2464"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-boolean\u2465"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-boolean\u2466"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-boolean\u2467"}, {"id": "ref-for-idl-boolean\u2468"}, {"id": "ref-for-idl-boolean\u2460\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2460"}, {"id": "ref-for-idl-boolean\u2460\u2461"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2462"}, {"id": "ref-for-idl-boolean\u2460\u2463"}, {"id": "ref-for-idl-boolean\u2460\u2464"}, {"id": "ref-for-idl-boolean\u2460\u2465"}, {"id": "ref-for-idl-boolean\u2460\u2466"}, {"id": "ref-for-idl-boolean\u2460\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2468"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": true};
-window.dfnpanelData['b05bf85d'] = {"dfnID": "b05bf85d", "url": "https://webidl.spec.whatwg.org/#dfn-buffer-source-type", "dfnText": "buffer source types", "refSections": [{"refs": [{"id": "ref-for-dfn-buffer-source-type"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dfn-buffer-source-type\u2460"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
+window.dfnpanelData['5372cca8'] = {"dfnID": "5372cca8", "url": "https://webidl.spec.whatwg.org/#idl-boolean", "dfnText": "boolean", "refSections": [{"refs": [{"id": "ref-for-idl-boolean"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-boolean\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-boolean\u2461"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-idl-boolean\u2462"}, {"id": "ref-for-idl-boolean\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-idl-boolean\u2464"}, {"id": "ref-for-idl-boolean\u2465"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-idl-boolean\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-idl-boolean\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-idl-boolean\u2468"}, {"id": "ref-for-idl-boolean\u2460\u24ea"}, {"id": "ref-for-idl-boolean\u2460\u2460"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2461"}, {"id": "ref-for-idl-boolean\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-idl-boolean\u2460\u2463"}, {"id": "ref-for-idl-boolean\u2460\u2464"}, {"id": "ref-for-idl-boolean\u2460\u2465"}, {"id": "ref-for-idl-boolean\u2460\u2466"}, {"id": "ref-for-idl-boolean\u2460\u2467"}, {"id": "ref-for-idl-boolean\u2460\u2468"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-idl-boolean\u2461\u24ea"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": true};
+window.dfnpanelData['b05bf85d'] = {"dfnID": "b05bf85d", "url": "https://webidl.spec.whatwg.org/#dfn-buffer-source-type", "dfnText": "buffer source types", "refSections": [{"refs": [{"id": "ref-for-dfn-buffer-source-type"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dfn-buffer-source-type\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
 window.dfnpanelData['7d1b8bad'] = {"dfnID": "7d1b8bad", "url": "https://heycam.github.io/webidl#dfn-get-buffer-source-copy", "dfnText": "get a copy of the bytes held by the buffer source", "refSections": [{"refs": [{"id": "ref-for-dfn-get-buffer-source-copy"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dfn-get-buffer-source-copy\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
 window.dfnpanelData['4197ac46'] = {"dfnID": "4197ac46", "url": "https://webidl.spec.whatwg.org/#dfn-interface-object", "dfnText": "interface object", "refSections": [{"refs": [{"id": "ref-for-dfn-interface-object"}, {"id": "ref-for-dfn-interface-object\u2460"}, {"id": "ref-for-dfn-interface-object\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dfn-interface-object\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}], "external": true};
-window.dfnpanelData['7b052415'] = {"dfnID": "7b052415", "url": "https://webidl.spec.whatwg.org/#dfn-json-types", "dfnText": "json type", "refSections": [{"refs": [{"id": "ref-for-dfn-json-types"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dfn-json-types\u2460"}, {"id": "ref-for-dfn-json-types\u2461"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dfn-json-types\u2462"}, {"id": "ref-for-dfn-json-types\u2463"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
+window.dfnpanelData['7b052415'] = {"dfnID": "7b052415", "url": "https://webidl.spec.whatwg.org/#dfn-json-types", "dfnText": "json type", "refSections": [{"refs": [{"id": "ref-for-dfn-json-types"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dfn-json-types\u2460"}, {"id": "ref-for-dfn-json-types\u2461"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dfn-json-types\u2462"}, {"id": "ref-for-dfn-json-types\u2463"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": true};
 window.dfnpanelData['f8de33a3'] = {"dfnID": "f8de33a3", "url": "https://webidl.spec.whatwg.org/#idl-long", "dfnText": "long", "refSections": [{"refs": [{"id": "ref-for-idl-long"}], "title": "5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}], "external": true};
 window.dfnpanelData['9aeb0a82'] = {"dfnID": "9aeb0a82", "url": "https://webidl.spec.whatwg.org/#idl-long-long", "dfnText": "long long", "refSections": [{"refs": [{"id": "ref-for-idl-long-long"}], "title": "5.1. PublicKeyCredential Interface"}], "external": true};
 window.dfnpanelData['7787d359'] = {"dfnID": "7787d359", "url": "https://webidl.spec.whatwg.org/#idl-record", "dfnText": "record", "refSections": [{"refs": [{"id": "ref-for-idl-record"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
-window.dfnpanelData['9cce47fd'] = {"dfnID": "9cce47fd", "url": "https://webidl.spec.whatwg.org/#idl-sequence", "dfnText": "sequence", "refSections": [{"refs": [{"id": "ref-for-idl-sequence"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-sequence\u2460"}, {"id": "ref-for-idl-sequence\u2461"}, {"id": "ref-for-idl-sequence\u2462"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-sequence\u2463"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-sequence\u2464"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-sequence\u2465"}, {"id": "ref-for-idl-sequence\u2466"}, {"id": "ref-for-idl-sequence\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2468"}, {"id": "ref-for-idl-sequence\u2460\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2461"}, {"id": "ref-for-idl-sequence\u2460\u2462"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2463"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
-window.dfnpanelData['e97a9688'] = {"dfnID": "e97a9688", "url": "https://webidl.spec.whatwg.org/#idl-unsigned-long", "dfnText": "unsigned long", "refSections": [{"refs": [{"id": "ref-for-idl-unsigned-long"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2460"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2461"}, {"id": "ref-for-idl-unsigned-long\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2463"}, {"id": "ref-for-idl-unsigned-long\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2465"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": true};
+window.dfnpanelData['9cce47fd'] = {"dfnID": "9cce47fd", "url": "https://webidl.spec.whatwg.org/#idl-sequence", "dfnText": "sequence", "refSections": [{"refs": [{"id": "ref-for-idl-sequence"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-idl-sequence\u2460"}, {"id": "ref-for-idl-sequence\u2461"}, {"id": "ref-for-idl-sequence\u2462"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-sequence\u2463"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-sequence\u2464"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-idl-sequence\u2465"}, {"id": "ref-for-idl-sequence\u2466"}, {"id": "ref-for-idl-sequence\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2468"}, {"id": "ref-for-idl-sequence\u2460\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2461"}, {"id": "ref-for-idl-sequence\u2460\u2462"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-idl-sequence\u2460\u2463"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
+window.dfnpanelData['e97a9688'] = {"dfnID": "e97a9688", "url": "https://webidl.spec.whatwg.org/#idl-unsigned-long", "dfnText": "unsigned long", "refSections": [{"refs": [{"id": "ref-for-idl-unsigned-long"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2461"}, {"id": "ref-for-idl-unsigned-long\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2463"}, {"id": "ref-for-idl-unsigned-long\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-idl-unsigned-long\u2465"}], "title": "10.2.1. User Verification Method Extension (uvm)"}], "external": true};
 window.dfnpanelData['81daedb9'] = {"dfnID": "81daedb9", "url": "https://html.spec.whatwg.org/#focus", "dfnText": "focus", "refSections": [{"refs": [{"id": "ref-for-focus"}], "title": "5.6. Abort Operations with AbortSignal"}], "external": true};
-window.dfnpanelData['base64url-encoding'] = {"dfnID": "base64url-encoding", "url": "#base64url-encoding", "dfnText": "Base64url Encoding", "refSections": [{"refs": [{"id": "ref-for-base64url-encoding"}, {"id": "ref-for-base64url-encoding\u2460"}, {"id": "ref-for-base64url-encoding\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-base64url-encoding\u2462"}, {"id": "ref-for-base64url-encoding\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2464"}, {"id": "ref-for-base64url-encoding\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2466"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-base64url-encoding\u2467"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2468"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u24ea"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2460"}], "title": "5.8.1.1. Serialization"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2461"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2462"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2463"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2464"}, {"id": "ref-for-base64url-encoding\u2460\u2465"}, {"id": "ref-for-base64url-encoding\u2460\u2466"}, {"id": "ref-for-base64url-encoding\u2460\u2467"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2468"}, {"id": "ref-for-base64url-encoding\u2461\u24ea"}, {"id": "ref-for-base64url-encoding\u2461\u2460"}, {"id": "ref-for-base64url-encoding\u2461\u2461"}, {"id": "ref-for-base64url-encoding\u2461\u2462"}, {"id": "ref-for-base64url-encoding\u2461\u2463"}, {"id": "ref-for-base64url-encoding\u2461\u2464"}, {"id": "ref-for-base64url-encoding\u2461\u2465"}], "title": "11.5. Add Credential"}], "external": false};
+window.dfnpanelData['base64url-encoding'] = {"dfnID": "base64url-encoding", "url": "#base64url-encoding", "dfnText": "Base64url Encoding", "refSections": [{"refs": [{"id": "ref-for-base64url-encoding"}, {"id": "ref-for-base64url-encoding\u2460"}, {"id": "ref-for-base64url-encoding\u2461"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-base64url-encoding\u2462"}, {"id": "ref-for-base64url-encoding\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2464"}, {"id": "ref-for-base64url-encoding\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2466"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-base64url-encoding\u2467"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-base64url-encoding\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u24ea"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2460"}], "title": "5.8.1.1. Serialization"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2461"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2462"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2463"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2464"}, {"id": "ref-for-base64url-encoding\u2460\u2465"}, {"id": "ref-for-base64url-encoding\u2460\u2466"}, {"id": "ref-for-base64url-encoding\u2460\u2467"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-base64url-encoding\u2460\u2468"}, {"id": "ref-for-base64url-encoding\u2461\u24ea"}, {"id": "ref-for-base64url-encoding\u2461\u2460"}, {"id": "ref-for-base64url-encoding\u2461\u2461"}, {"id": "ref-for-base64url-encoding\u2461\u2462"}, {"id": "ref-for-base64url-encoding\u2461\u2463"}, {"id": "ref-for-base64url-encoding\u2461\u2464"}, {"id": "ref-for-base64url-encoding\u2461\u2465"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['cbor'] = {"dfnID": "cbor", "url": "#cbor", "dfnText": "CBOR", "refSections": [{"refs": [{"id": "ref-for-cbor"}], "title": "2.4. All Conformance Classes"}, {"refs": [{"id": "ref-for-cbor\u2460"}], "title": "3. Dependencies"}, {"refs": [{"id": "ref-for-cbor\u2461"}, {"id": "ref-for-cbor\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-cbor\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-cbor\u2464"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-cbor\u2465"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-cbor\u2466"}, {"id": "ref-for-cbor\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-cbor\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-cbor\u2460\u24ea"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-cbor\u2460\u2460"}, {"id": "ref-for-cbor\u2460\u2461"}, {"id": "ref-for-cbor\u2460\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-cbor\u2460\u2463"}, {"id": "ref-for-cbor\u2460\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-cbor\u2460\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-cbor\u2460\u2466"}, {"id": "ref-for-cbor\u2460\u2467"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-cbor\u2460\u2468"}, {"id": "ref-for-cbor\u2461\u24ea"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-cbor\u2461\u2460"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
 window.dfnpanelData['cddl'] = {"dfnID": "cddl", "url": "#cddl", "dfnText": "CDDL", "refSections": [{"refs": [{"id": "ref-for-cddl"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-cddl\u2460"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-cddl\u2461"}], "title": "9.3. Extending Request Parameters"}], "external": false};
 window.dfnpanelData['attestation'] = {"dfnID": "attestation", "url": "#attestation", "dfnText": "Attestation", "refSections": [{"refs": [{"id": "ref-for-attestation\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-attestation\u2462"}, {"id": "ref-for-attestation\u2463"}, {"id": "ref-for-attestation\u2464"}, {"id": "ref-for-attestation\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-attestation\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-attestation\u2467"}, {"id": "ref-for-attestation\u2468"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-attestation\u2460\u24ea"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-attestation\u2460\u2462"}, {"id": "ref-for-attestation\u2460\u2463"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-attestation\u2460\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation\u2460\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-attestation\u2460\u2466"}, {"id": "ref-for-attestation\u2460\u2467"}, {"id": "ref-for-attestation\u2460\u2468"}, {"id": "ref-for-attestation\u2461\u24ea"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-attestation\u2461\u2460"}, {"id": "ref-for-attestation\u2461\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation\u2461\u2462"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation\u2461\u2463"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation\u2461\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-attestation\u2461\u2465"}], "title": "12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-attestation\u2461\u2466"}], "title": "13. Security Considerations"}], "external": false};
@@ -10978,15 +11003,16 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['contains'] = {"dfnID": "contains", "url": "#contains", "dfnText": "contains", "refSections": [{"refs": [{"id": "ref-for-contains"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-contains\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-contains\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}], "external": false};
 window.dfnpanelData['created-on'] = {"dfnID": "created-on", "url": "#created-on", "dfnText": "created on", "refSections": [{"refs": [{"id": "ref-for-created-on"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-created-on\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}], "external": false};
 window.dfnpanelData['ceremony'] = {"dfnID": "ceremony", "url": "#ceremony", "dfnText": "Ceremony", "refSections": [{"refs": [{"id": "ref-for-ceremony"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-ceremony\u2460"}, {"id": "ref-for-ceremony\u2461"}, {"id": "ref-for-ceremony\u2462"}, {"id": "ref-for-ceremony\u2463"}, {"id": "ref-for-ceremony\u2464"}, {"id": "ref-for-ceremony\u2465"}, {"id": "ref-for-ceremony\u2466"}, {"id": "ref-for-ceremony\u2467"}, {"id": "ref-for-ceremony\u2468"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-ceremony\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2460"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2461"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2462"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2463"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2464"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2465"}, {"id": "ref-for-ceremony\u2460\u2466"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-ceremony\u2460\u2467"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['client'] = {"dfnID": "client", "url": "#client", "dfnText": "Client", "refSections": [{"refs": [{"id": "ref-for-client"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-client\u2460"}, {"id": "ref-for-client\u2461"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client\u2462"}, {"id": "ref-for-client\u2463"}, {"id": "ref-for-client\u2464"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client\u2465"}, {"id": "ref-for-client\u2466"}, {"id": "ref-for-client\u2467"}, {"id": "ref-for-client\u2468"}, {"id": "ref-for-client\u2460\u24ea"}, {"id": "ref-for-client\u2460\u2460"}, {"id": "ref-for-client\u2460\u2461"}, {"id": "ref-for-client\u2460\u2462"}, {"id": "ref-for-client\u2460\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client\u2460\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-client\u2460\u2465"}, {"id": "ref-for-client\u2460\u2466"}, {"id": "ref-for-client\u2460\u2467"}, {"id": "ref-for-client\u2460\u2468"}, {"id": "ref-for-client\u2461\u24ea"}, {"id": "ref-for-client\u2461\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2461"}, {"id": "ref-for-client\u2461\u2462"}, {"id": "ref-for-client\u2461\u2463"}, {"id": "ref-for-client\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client\u2461\u2466"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2467"}, {"id": "ref-for-client\u2461\u2468"}, {"id": "ref-for-client\u2462\u24ea"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client\u2462\u2460"}, {"id": "ref-for-client\u2462\u2461"}, {"id": "ref-for-client\u2462\u2462"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client\u2462\u2463"}, {"id": "ref-for-client\u2462\u2464"}, {"id": "ref-for-client\u2462\u2465"}, {"id": "ref-for-client\u2462\u2466"}, {"id": "ref-for-client\u2462\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client\u2462\u2468"}, {"id": "ref-for-client\u2463\u24ea"}, {"id": "ref-for-client\u2463\u2460"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2461"}, {"id": "ref-for-client\u2463\u2462"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2463"}, {"id": "ref-for-client\u2463\u2464"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-client\u2463\u2465"}, {"id": "ref-for-client\u2463\u2466"}, {"id": "ref-for-client\u2463\u2467"}, {"id": "ref-for-client\u2463\u2468"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-client\u2464\u24ea"}, {"id": "ref-for-client\u2464\u2460"}, {"id": "ref-for-client\u2464\u2461"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-client\u2464\u2462"}, {"id": "ref-for-client\u2464\u2463"}, {"id": "ref-for-client\u2464\u2464"}, {"id": "ref-for-client\u2464\u2465"}, {"id": "ref-for-client\u2464\u2466"}, {"id": "ref-for-client\u2464\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client\u2464\u2468"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-client\u2465\u24ea"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client\u2465\u2460"}, {"id": "ref-for-client\u2465\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client\u2465\u2462"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-client\u2465\u2463"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-client\u2465\u2464"}, {"id": "ref-for-client\u2465\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client\u2465\u2466"}, {"id": "ref-for-client\u2465\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client\u2465\u2468"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client\u2466\u24ea"}, {"id": "ref-for-client\u2466\u2460"}, {"id": "ref-for-client\u2466\u2461"}, {"id": "ref-for-client\u2466\u2462"}, {"id": "ref-for-client\u2466\u2463"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2464"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2465"}, {"id": "ref-for-client\u2466\u2466"}, {"id": "ref-for-client\u2466\u2467"}, {"id": "ref-for-client\u2466\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-client\u2467\u24ea"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-client\u2467\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client\u2467\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client\u2467\u2462"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-client\u2467\u2463"}, {"id": "ref-for-client\u2467\u2464"}, {"id": "ref-for-client\u2467\u2465"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client\u2467\u2466"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client\u2467\u2467"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client\u2467\u2468"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-client\u2468\u24ea"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-client\u2468\u2460"}, {"id": "ref-for-client\u2468\u2461"}, {"id": "ref-for-client\u2468\u2462"}, {"id": "ref-for-client\u2468\u2463"}, {"id": "ref-for-client\u2468\u2464"}, {"id": "ref-for-client\u2468\u2465"}, {"id": "ref-for-client\u2468\u2466"}, {"id": "ref-for-client\u2468\u2467"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-client\u2468\u2468"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u24ea"}, {"id": "ref-for-client\u2460\u24ea\u2460"}, {"id": "ref-for-client\u2460\u24ea\u2461"}, {"id": "ref-for-client\u2460\u24ea\u2462"}, {"id": "ref-for-client\u2460\u24ea\u2463"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2464"}, {"id": "ref-for-client\u2460\u24ea\u2465"}, {"id": "ref-for-client\u2460\u24ea\u2466"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2468"}, {"id": "ref-for-client\u2460\u2460\u24ea"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2460"}], "title": "14.5. Privacy considerations for clients"}], "external": false};
+window.dfnpanelData['client'] = {"dfnID": "client", "url": "#client", "dfnText": "Client", "refSections": [{"refs": [{"id": "ref-for-client"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-client\u2460"}, {"id": "ref-for-client\u2461"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client\u2462"}, {"id": "ref-for-client\u2463"}, {"id": "ref-for-client\u2464"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client\u2465"}, {"id": "ref-for-client\u2466"}, {"id": "ref-for-client\u2467"}, {"id": "ref-for-client\u2468"}, {"id": "ref-for-client\u2460\u24ea"}, {"id": "ref-for-client\u2460\u2460"}, {"id": "ref-for-client\u2460\u2461"}, {"id": "ref-for-client\u2460\u2462"}, {"id": "ref-for-client\u2460\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client\u2460\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-client\u2460\u2465"}, {"id": "ref-for-client\u2460\u2466"}, {"id": "ref-for-client\u2460\u2467"}, {"id": "ref-for-client\u2460\u2468"}, {"id": "ref-for-client\u2461\u24ea"}, {"id": "ref-for-client\u2461\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2461"}, {"id": "ref-for-client\u2461\u2462"}, {"id": "ref-for-client\u2461\u2463"}, {"id": "ref-for-client\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client\u2461\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client\u2461\u2466"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2467"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client\u2461\u2468"}, {"id": "ref-for-client\u2462\u24ea"}, {"id": "ref-for-client\u2462\u2460"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client\u2462\u2461"}, {"id": "ref-for-client\u2462\u2462"}, {"id": "ref-for-client\u2462\u2463"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client\u2462\u2464"}, {"id": "ref-for-client\u2462\u2465"}, {"id": "ref-for-client\u2462\u2466"}, {"id": "ref-for-client\u2462\u2467"}, {"id": "ref-for-client\u2462\u2468"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client\u2463\u24ea"}, {"id": "ref-for-client\u2463\u2460"}, {"id": "ref-for-client\u2463\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2462"}, {"id": "ref-for-client\u2463\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client\u2463\u2464"}, {"id": "ref-for-client\u2463\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-client\u2463\u2466"}, {"id": "ref-for-client\u2463\u2467"}, {"id": "ref-for-client\u2463\u2468"}, {"id": "ref-for-client\u2464\u24ea"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-client\u2464\u2460"}, {"id": "ref-for-client\u2464\u2461"}, {"id": "ref-for-client\u2464\u2462"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-client\u2464\u2463"}, {"id": "ref-for-client\u2464\u2464"}, {"id": "ref-for-client\u2464\u2465"}, {"id": "ref-for-client\u2464\u2466"}, {"id": "ref-for-client\u2464\u2467"}, {"id": "ref-for-client\u2464\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client\u2465\u24ea"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-client\u2465\u2460"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client\u2465\u2461"}, {"id": "ref-for-client\u2465\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client\u2465\u2463"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-client\u2465\u2464"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-client\u2465\u2465"}, {"id": "ref-for-client\u2465\u2466"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client\u2465\u2467"}, {"id": "ref-for-client\u2465\u2468"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client\u2466\u24ea"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client\u2466\u2460"}, {"id": "ref-for-client\u2466\u2461"}, {"id": "ref-for-client\u2466\u2462"}, {"id": "ref-for-client\u2466\u2463"}, {"id": "ref-for-client\u2466\u2464"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client\u2466\u2466"}, {"id": "ref-for-client\u2466\u2467"}, {"id": "ref-for-client\u2466\u2468"}, {"id": "ref-for-client\u2467\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-client\u2467\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-client\u2467\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client\u2467\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client\u2467\u2463"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-client\u2467\u2464"}, {"id": "ref-for-client\u2467\u2465"}, {"id": "ref-for-client\u2467\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client\u2467\u2467"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client\u2467\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client\u2468\u24ea"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-client\u2468\u2460"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-client\u2468\u2461"}, {"id": "ref-for-client\u2468\u2462"}, {"id": "ref-for-client\u2468\u2463"}, {"id": "ref-for-client\u2468\u2464"}, {"id": "ref-for-client\u2468\u2465"}, {"id": "ref-for-client\u2468\u2466"}, {"id": "ref-for-client\u2468\u2467"}, {"id": "ref-for-client\u2468\u2468"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u24ea"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2460"}, {"id": "ref-for-client\u2460\u24ea\u2461"}, {"id": "ref-for-client\u2460\u24ea\u2462"}, {"id": "ref-for-client\u2460\u24ea\u2463"}, {"id": "ref-for-client\u2460\u24ea\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2465"}, {"id": "ref-for-client\u2460\u24ea\u2466"}, {"id": "ref-for-client\u2460\u24ea\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-client\u2460\u24ea\u2468"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u24ea"}, {"id": "ref-for-client\u2460\u2460\u2460"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-client\u2460\u2460\u2461"}], "title": "14.5. Privacy considerations for clients"}], "external": false};
 window.dfnpanelData['webauthn-client'] = {"dfnID": "webauthn-client", "url": "#webauthn-client", "dfnText": "WebAuthn Client", "refSections": [{"refs": [{"id": "ref-for-webauthn-client"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-webauthn-client\u2460"}, {"id": "ref-for-webauthn-client\u2461"}, {"id": "ref-for-webauthn-client\u2462"}, {"id": "ref-for-webauthn-client\u2463"}, {"id": "ref-for-webauthn-client\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-client\u2465"}], "title": "6.3. Authenticator Operations"}, {"refs": [{"id": "ref-for-webauthn-client\u2466"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-client\u2467"}], "title": "13.4.8. Code injection attacks"}], "external": false};
 window.dfnpanelData['client-device'] = {"dfnID": "client-device", "url": "#client-device", "dfnText": "Client Device", "refSections": [{"refs": [{"id": "ref-for-client-device"}, {"id": "ref-for-client-device\u2460"}, {"id": "ref-for-client-device\u2461"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-client-device\u2462"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-client-device\u2463"}, {"id": "ref-for-client-device\u2464"}, {"id": "ref-for-client-device\u2465"}, {"id": "ref-for-client-device\u2466"}, {"id": "ref-for-client-device\u2467"}, {"id": "ref-for-client-device\u2468"}, {"id": "ref-for-client-device\u2460\u24ea"}, {"id": "ref-for-client-device\u2460\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-device\u2460\u2461"}, {"id": "ref-for-client-device\u2460\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-device\u2460\u2463"}, {"id": "ref-for-client-device\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-device\u2460\u2465"}, {"id": "ref-for-client-device\u2460\u2466"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-client-device\u2460\u2467"}, {"id": "ref-for-client-device\u2460\u2468"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-client-device\u2461\u24ea"}, {"id": "ref-for-client-device\u2461\u2460"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client-device\u2461\u2461"}, {"id": "ref-for-client-device\u2461\u2462"}, {"id": "ref-for-client-device\u2461\u2463"}, {"id": "ref-for-client-device\u2461\u2464"}, {"id": "ref-for-client-device\u2461\u2465"}, {"id": "ref-for-client-device\u2461\u2466"}, {"id": "ref-for-client-device\u2461\u2467"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client-device\u2461\u2468"}, {"id": "ref-for-client-device\u2462\u24ea"}, {"id": "ref-for-client-device\u2462\u2460"}, {"id": "ref-for-client-device\u2462\u2461"}, {"id": "ref-for-client-device\u2462\u2462"}, {"id": "ref-for-client-device\u2462\u2463"}, {"id": "ref-for-client-device\u2462\u2464"}, {"id": "ref-for-client-device\u2462\u2465"}, {"id": "ref-for-client-device\u2462\u2466"}, {"id": "ref-for-client-device\u2462\u2467"}, {"id": "ref-for-client-device\u2462\u2468"}, {"id": "ref-for-client-device\u2463\u24ea"}, {"id": "ref-for-client-device\u2463\u2460"}, {"id": "ref-for-client-device\u2463\u2461"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-client-device\u2463\u2462"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client-device\u2463\u2463"}, {"id": "ref-for-client-device\u2463\u2464"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-client-device\u2463\u2465"}, {"id": "ref-for-client-device\u2463\u2466"}], "title": "14.5.3. Privacy Between Operating System Accounts"}], "external": false};
 window.dfnpanelData['webauthn-client-device'] = {"dfnID": "webauthn-client-device", "url": "#webauthn-client-device", "dfnText": "WebAuthn Client Device", "refSections": [{"refs": [{"id": "ref-for-webauthn-client-device"}, {"id": "ref-for-webauthn-client-device\u2460"}], "title": "4. Terminology"}], "external": false};
-window.dfnpanelData['client-platform'] = {"dfnID": "client-platform", "url": "#client-platform", "dfnText": "Client Platform", "refSections": [{"refs": [{"id": "ref-for-client-platform"}, {"id": "ref-for-client-platform\u2460"}, {"id": "ref-for-client-platform\u2461"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-client-platform\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client-platform\u2463"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client-platform\u2464"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-client-platform\u2465"}, {"id": "ref-for-client-platform\u2466"}, {"id": "ref-for-client-platform\u2467"}, {"id": "ref-for-client-platform\u2468"}, {"id": "ref-for-client-platform\u2460\u24ea"}, {"id": "ref-for-client-platform\u2460\u2460"}, {"id": "ref-for-client-platform\u2460\u2461"}, {"id": "ref-for-client-platform\u2460\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2463"}, {"id": "ref-for-client-platform\u2460\u2464"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2465"}, {"id": "ref-for-client-platform\u2460\u2466"}, {"id": "ref-for-client-platform\u2460\u2467"}, {"id": "ref-for-client-platform\u2460\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u24ea"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2460"}, {"id": "ref-for-client-platform\u2461\u2461"}, {"id": "ref-for-client-platform\u2461\u2462"}, {"id": "ref-for-client-platform\u2461\u2463"}, {"id": "ref-for-client-platform\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2465"}, {"id": "ref-for-client-platform\u2461\u2466"}, {"id": "ref-for-client-platform\u2461\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2468"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u24ea"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2462"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2463"}, {"id": "ref-for-client-platform\u2462\u2464"}, {"id": "ref-for-client-platform\u2462\u2465"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2466"}, {"id": "ref-for-client-platform\u2462\u2467"}, {"id": "ref-for-client-platform\u2462\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u24ea"}, {"id": "ref-for-client-platform\u2463\u2460"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2461"}, {"id": "ref-for-client-platform\u2463\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2463"}, {"id": "ref-for-client-platform\u2463\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2465"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2466"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2468"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-platform\u2464\u24ea"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2460"}, {"id": "ref-for-client-platform\u2464\u2461"}, {"id": "ref-for-client-platform\u2464\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2463"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2464"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2465"}, {"id": "ref-for-client-platform\u2464\u2466"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['client-platform'] = {"dfnID": "client-platform", "url": "#client-platform", "dfnText": "Client Platform", "refSections": [{"refs": [{"id": "ref-for-client-platform"}, {"id": "ref-for-client-platform\u2460"}, {"id": "ref-for-client-platform\u2461"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-client-platform\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-client-platform\u2463"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-client-platform\u2464"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-client-platform\u2465"}, {"id": "ref-for-client-platform\u2466"}, {"id": "ref-for-client-platform\u2467"}, {"id": "ref-for-client-platform\u2468"}, {"id": "ref-for-client-platform\u2460\u24ea"}, {"id": "ref-for-client-platform\u2460\u2460"}, {"id": "ref-for-client-platform\u2460\u2461"}, {"id": "ref-for-client-platform\u2460\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2463"}, {"id": "ref-for-client-platform\u2460\u2464"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-client-platform\u2460\u2465"}, {"id": "ref-for-client-platform\u2460\u2466"}, {"id": "ref-for-client-platform\u2460\u2467"}, {"id": "ref-for-client-platform\u2460\u2468"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u24ea"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2460"}, {"id": "ref-for-client-platform\u2461\u2461"}, {"id": "ref-for-client-platform\u2461\u2462"}, {"id": "ref-for-client-platform\u2461\u2463"}, {"id": "ref-for-client-platform\u2461\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2465"}, {"id": "ref-for-client-platform\u2461\u2466"}, {"id": "ref-for-client-platform\u2461\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client-platform\u2461\u2468"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u24ea"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2460"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2464"}, {"id": "ref-for-client-platform\u2462\u2465"}, {"id": "ref-for-client-platform\u2462\u2466"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-client-platform\u2462\u2467"}, {"id": "ref-for-client-platform\u2462\u2468"}, {"id": "ref-for-client-platform\u2463\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2460"}, {"id": "ref-for-client-platform\u2463\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2462"}, {"id": "ref-for-client-platform\u2463\u2463"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2464"}, {"id": "ref-for-client-platform\u2463\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2467"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-platform\u2463\u2468"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-platform\u2464\u24ea"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2460"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2461"}, {"id": "ref-for-client-platform\u2464\u2462"}, {"id": "ref-for-client-platform\u2464\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2465"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-client-platform\u2464\u2466"}, {"id": "ref-for-client-platform\u2464\u2467"}], "title": "15. Accessibility Considerations"}], "external": false};
 window.dfnpanelData['client-side'] = {"dfnID": "client-side", "url": "#client-side", "dfnText": "Client-Side", "refSections": [{"refs": [{"id": "ref-for-client-side"}, {"id": "ref-for-client-side\u2460"}], "title": "4. Terminology"}], "external": false};
 window.dfnpanelData['client-side-discoverable-public-key-credential-source'] = {"dfnID": "client-side-discoverable-public-key-credential-source", "url": "#client-side-discoverable-public-key-credential-source", "dfnText": "Client-side discoverable Public Key Credential Source", "refSections": [{"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2460"}, {"id": "ref-for-client-side-discoverable-public-key-credential-source\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2462"}, {"id": "ref-for-client-side-discoverable-public-key-credential-source\u2463"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2464"}, {"id": "ref-for-client-side-discoverable-public-key-credential-source\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2466"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-client-side-discoverable-public-key-credential-source\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}], "external": false};
 window.dfnpanelData['client-side-discoverable-credential'] = {"dfnID": "client-side-discoverable-credential", "url": "#client-side-discoverable-credential", "dfnText": "Client-side discoverable Credential", "refSections": [{"refs": [{"id": "ref-for-client-side-discoverable-credential"}, {"id": "ref-for-client-side-discoverable-credential\u2460"}, {"id": "ref-for-client-side-discoverable-credential\u2461"}, {"id": "ref-for-client-side-discoverable-credential\u2462"}, {"id": "ref-for-client-side-discoverable-credential\u2463"}, {"id": "ref-for-client-side-discoverable-credential\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2465"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2466"}, {"id": "ref-for-client-side-discoverable-credential\u2467"}, {"id": "ref-for-client-side-discoverable-credential\u2468"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u24ea"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u2460"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u2461"}, {"id": "ref-for-client-side-discoverable-credential\u2460\u2462"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2464"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2465"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2466"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-client-side-discoverable-credential\u2460\u2467"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": false};
 window.dfnpanelData['discoverable-credential'] = {"dfnID": "discoverable-credential", "url": "#discoverable-credential", "dfnText": "Discoverable Credential", "refSections": [{"refs": [{"id": "ref-for-discoverable-credential"}, {"id": "ref-for-discoverable-credential\u2460"}, {"id": "ref-for-discoverable-credential\u2461"}, {"id": "ref-for-discoverable-credential\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-discoverable-credential\u2463"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-discoverable-credential\u2464"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-discoverable-credential\u2465"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-discoverable-credential\u2466"}, {"id": "ref-for-discoverable-credential\u2467"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-discoverable-credential\u2468"}, {"id": "ref-for-discoverable-credential\u2460\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-discoverable-credential\u2460\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-discoverable-credential\u2460\u2461"}, {"id": "ref-for-discoverable-credential\u2460\u2462"}, {"id": "ref-for-discoverable-credential\u2460\u2463"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-discoverable-credential\u2460\u2464"}, {"id": "ref-for-discoverable-credential\u2460\u2465"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};
+window.dfnpanelData['passkey'] = {"dfnID": "passkey", "url": "#passkey", "dfnText": "Passkey", "refSections": [{"refs": [{"id": "ref-for-passkey"}, {"id": "ref-for-passkey\u2460"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}], "external": false};
 window.dfnpanelData['resident-credential'] = {"dfnID": "resident-credential", "url": "#resident-credential", "dfnText": "Resident Credential", "refSections": [{"refs": [{"id": "ref-for-resident-credential"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-resident-credential\u2460"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
 window.dfnpanelData['resident-key'] = {"dfnID": "resident-key", "url": "#resident-key", "dfnText": "Resident Key", "refSections": [{"refs": [{"id": "ref-for-resident-key"}, {"id": "ref-for-resident-key\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-resident-key\u2461"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}], "external": false};
 window.dfnpanelData['conforming-user-agent'] = {"dfnID": "conforming-user-agent", "url": "#conforming-user-agent", "dfnText": "Conforming User Agent", "refSections": [{"refs": [{"id": "ref-for-conforming-user-agent"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2460"}], "title": "2.1. User Agents"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2461"}], "title": "2.2. Authenticators"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-conforming-user-agent\u2463"}], "title": "6.4.1. String Truncation"}], "external": false};
@@ -11029,8 +11055,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['rate-limiting'] = {"dfnID": "rate-limiting", "url": "#rate-limiting", "dfnText": "Rate Limiting", "refSections": [{"refs": [{"id": "ref-for-rate-limiting"}, {"id": "ref-for-rate-limiting\u2460"}], "title": "4. Terminology"}], "external": false};
 window.dfnpanelData['registration'] = {"dfnID": "registration", "url": "#registration", "dfnText": "Registration", "refSections": [{"refs": [{"id": "ref-for-registration"}, {"id": "ref-for-registration\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-registration\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-registration\u2462"}, {"id": "ref-for-registration\u2463"}, {"id": "ref-for-registration\u2464"}, {"id": "ref-for-registration\u2465"}, {"id": "ref-for-registration\u2466"}, {"id": "ref-for-registration\u2467"}, {"id": "ref-for-registration\u2468"}, {"id": "ref-for-registration\u2460\u24ea"}, {"id": "ref-for-registration\u2460\u2460"}, {"id": "ref-for-registration\u2460\u2461"}, {"id": "ref-for-registration\u2460\u2462"}, {"id": "ref-for-registration\u2460\u2463"}, {"id": "ref-for-registration\u2460\u2464"}, {"id": "ref-for-registration\u2460\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration\u2460\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-registration\u2460\u2467"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-registration\u2460\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration\u2461\u24ea"}, {"id": "ref-for-registration\u2461\u2460"}, {"id": "ref-for-registration\u2461\u2461"}, {"id": "ref-for-registration\u2461\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration\u2461\u2463"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-registration\u2461\u2464"}, {"id": "ref-for-registration\u2461\u2465"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-registration\u2461\u2466"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-registration\u2461\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-registration\u2461\u2468"}], "title": "15. Accessibility Considerations"}, {"refs": [{"id": "ref-for-registration\u2462\u24ea"}], "title": "16. Acknowledgements"}], "external": false};
 window.dfnpanelData['registration-ceremony'] = {"dfnID": "registration-ceremony", "url": "#registration-ceremony", "dfnText": "Registration Ceremony", "refSections": [{"refs": [{"id": "ref-for-registration-ceremony"}, {"id": "ref-for-registration-ceremony\u2460"}, {"id": "ref-for-registration-ceremony\u2461"}, {"id": "ref-for-registration-ceremony\u2462"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration-ceremony\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-registration-ceremony\u2464"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2465"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-registration-ceremony\u2466"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2467"}, {"id": "ref-for-registration-ceremony\u2468"}, {"id": "ref-for-registration-ceremony\u2460\u24ea"}, {"id": "ref-for-registration-ceremony\u2460\u2460"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2461"}, {"id": "ref-for-registration-ceremony\u2460\u2462"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2463"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2464"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2465"}, {"id": "ref-for-registration-ceremony\u2460\u2466"}, {"id": "ref-for-registration-ceremony\u2460\u2467"}, {"id": "ref-for-registration-ceremony\u2460\u2468"}, {"id": "ref-for-registration-ceremony\u2461\u24ea"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-registration-ceremony\u2461\u2460"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['relying-party'] = {"dfnID": "relying-party", "url": "#relying-party", "dfnText": "Relying Party", "refSections": [{"refs": [{"id": "ref-for-relying-party\u2460"}, {"id": "ref-for-relying-party\u2461"}, {"id": "ref-for-relying-party\u2462"}, {"id": "ref-for-relying-party\u2463"}, {"id": "ref-for-relying-party\u2464"}, {"id": "ref-for-relying-party\u2465"}, {"id": "ref-for-relying-party\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-relying-party\u2467"}, {"id": "ref-for-relying-party\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2468"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2468"}, {"id": "ref-for-relying-party\u2464\u24ea"}, {"id": "ref-for-relying-party\u2464\u2460"}, {"id": "ref-for-relying-party\u2464\u2461"}, {"id": "ref-for-relying-party\u2464\u2462"}, {"id": "ref-for-relying-party\u2464\u2463"}, {"id": "ref-for-relying-party\u2464\u2464"}, {"id": "ref-for-relying-party\u2464\u2465"}, {"id": "ref-for-relying-party\u2464\u2466"}, {"id": "ref-for-relying-party\u2464\u2467"}, {"id": "ref-for-relying-party\u2464\u2468"}, {"id": "ref-for-relying-party\u2465\u24ea"}, {"id": "ref-for-relying-party\u2465\u2460"}, {"id": "ref-for-relying-party\u2465\u2461"}, {"id": "ref-for-relying-party\u2465\u2462"}, {"id": "ref-for-relying-party\u2465\u2463"}, {"id": "ref-for-relying-party\u2465\u2464"}, {"id": "ref-for-relying-party\u2465\u2465"}, {"id": "ref-for-relying-party\u2465\u2466"}, {"id": "ref-for-relying-party\u2465\u2467"}, {"id": "ref-for-relying-party\u2465\u2468"}, {"id": "ref-for-relying-party\u2466\u24ea"}, {"id": "ref-for-relying-party\u2466\u2460"}, {"id": "ref-for-relying-party\u2466\u2461"}, {"id": "ref-for-relying-party\u2466\u2462"}, {"id": "ref-for-relying-party\u2466\u2463"}, {"id": "ref-for-relying-party\u2466\u2464"}, {"id": "ref-for-relying-party\u2466\u2465"}, {"id": "ref-for-relying-party\u2466\u2466"}, {"id": "ref-for-relying-party\u2466\u2467"}, {"id": "ref-for-relying-party\u2466\u2468"}, {"id": "ref-for-relying-party\u2467\u24ea"}, {"id": "ref-for-relying-party\u2467\u2460"}, {"id": "ref-for-relying-party\u2467\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party\u2467\u2462"}, {"id": "ref-for-relying-party\u2467\u2463"}, {"id": "ref-for-relying-party\u2467\u2464"}, {"id": "ref-for-relying-party\u2467\u2465"}, {"id": "ref-for-relying-party\u2467\u2466"}, {"id": "ref-for-relying-party\u2467\u2467"}, {"id": "ref-for-relying-party\u2467\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party\u2468\u24ea"}, {"id": "ref-for-relying-party\u2468\u2460"}, {"id": "ref-for-relying-party\u2468\u2461"}, {"id": "ref-for-relying-party\u2468\u2462"}, {"id": "ref-for-relying-party\u2468\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2464"}, {"id": "ref-for-relying-party\u2468\u2465"}, {"id": "ref-for-relying-party\u2468\u2466"}, {"id": "ref-for-relying-party\u2468\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2460\u24ea\u2460"}, {"id": "ref-for-relying-party\u2460\u24ea\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2462"}, {"id": "ref-for-relying-party\u2460\u24ea\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2465"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2466"}, {"id": "ref-for-relying-party\u2460\u24ea\u2467"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2468"}, {"id": "ref-for-relying-party\u2460\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2460\u2464"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2465"}, {"id": "ref-for-relying-party\u2460\u2460\u2466"}, {"id": "ref-for-relying-party\u2460\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2460\u2468"}, {"id": "ref-for-relying-party\u2460\u2461\u24ea"}, {"id": "ref-for-relying-party\u2460\u2461\u2460"}, {"id": "ref-for-relying-party\u2460\u2461\u2461"}, {"id": "ref-for-relying-party\u2460\u2461\u2462"}, {"id": "ref-for-relying-party\u2460\u2461\u2463"}, {"id": "ref-for-relying-party\u2460\u2461\u2464"}, {"id": "ref-for-relying-party\u2460\u2461\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2461\u2466"}, {"id": "ref-for-relying-party\u2460\u2461\u2467"}, {"id": "ref-for-relying-party\u2460\u2461\u2468"}, {"id": "ref-for-relying-party\u2460\u2462\u24ea"}, {"id": "ref-for-relying-party\u2460\u2462\u2460"}, {"id": "ref-for-relying-party\u2460\u2462\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2462"}, {"id": "ref-for-relying-party\u2460\u2462\u2463"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2464"}, {"id": "ref-for-relying-party\u2460\u2462\u2465"}, {"id": "ref-for-relying-party\u2460\u2462\u2466"}, {"id": "ref-for-relying-party\u2460\u2462\u2467"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2468"}, {"id": "ref-for-relying-party\u2460\u2463\u24ea"}, {"id": "ref-for-relying-party\u2460\u2463\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2461"}, {"id": "ref-for-relying-party\u2460\u2463\u2462"}, {"id": "ref-for-relying-party\u2460\u2463\u2463"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2464"}, {"id": "ref-for-relying-party\u2460\u2463\u2465"}, {"id": "ref-for-relying-party\u2460\u2463\u2466"}, {"id": "ref-for-relying-party\u2460\u2463\u2467"}, {"id": "ref-for-relying-party\u2460\u2463\u2468"}, {"id": "ref-for-relying-party\u2460\u2464\u24ea"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2460"}, {"id": "ref-for-relying-party\u2460\u2464\u2461"}, {"id": "ref-for-relying-party\u2460\u2464\u2462"}, {"id": "ref-for-relying-party\u2460\u2464\u2463"}, {"id": "ref-for-relying-party\u2460\u2464\u2464"}, {"id": "ref-for-relying-party\u2460\u2464\u2465"}, {"id": "ref-for-relying-party\u2460\u2464\u2466"}, {"id": "ref-for-relying-party\u2460\u2464\u2467"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2468"}, {"id": "ref-for-relying-party\u2460\u2465\u24ea"}, {"id": "ref-for-relying-party\u2460\u2465\u2460"}, {"id": "ref-for-relying-party\u2460\u2465\u2461"}, {"id": "ref-for-relying-party\u2460\u2465\u2462"}, {"id": "ref-for-relying-party\u2460\u2465\u2463"}, {"id": "ref-for-relying-party\u2460\u2465\u2464"}, {"id": "ref-for-relying-party\u2460\u2465\u2465"}, {"id": "ref-for-relying-party\u2460\u2465\u2466"}, {"id": "ref-for-relying-party\u2460\u2465\u2467"}, {"id": "ref-for-relying-party\u2460\u2465\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u24ea"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2460"}, {"id": "ref-for-relying-party\u2460\u2466\u2461"}, {"id": "ref-for-relying-party\u2460\u2466\u2462"}, {"id": "ref-for-relying-party\u2460\u2466\u2463"}, {"id": "ref-for-relying-party\u2460\u2466\u2464"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2465"}, {"id": "ref-for-relying-party\u2460\u2466\u2466"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2467"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2468"}, {"id": "ref-for-relying-party\u2460\u2467\u24ea"}, {"id": "ref-for-relying-party\u2460\u2467\u2460"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2461"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2462"}, {"id": "ref-for-relying-party\u2460\u2467\u2463"}, {"id": "ref-for-relying-party\u2460\u2467\u2464"}, {"id": "ref-for-relying-party\u2460\u2467\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2467"}, {"id": "ref-for-relying-party\u2460\u2467\u2468"}, {"id": "ref-for-relying-party\u2460\u2468\u24ea"}, {"id": "ref-for-relying-party\u2460\u2468\u2460"}, {"id": "ref-for-relying-party\u2460\u2468\u2461"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2462"}, {"id": "ref-for-relying-party\u2460\u2468\u2463"}, {"id": "ref-for-relying-party\u2460\u2468\u2464"}, {"id": "ref-for-relying-party\u2460\u2468\u2465"}, {"id": "ref-for-relying-party\u2460\u2468\u2466"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2467"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2461\u24ea\u2460"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2461"}, {"id": "ref-for-relying-party\u2461\u24ea\u2462"}, {"id": "ref-for-relying-party\u2461\u24ea\u2463"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2464"}, {"id": "ref-for-relying-party\u2461\u24ea\u2465"}, {"id": "ref-for-relying-party\u2461\u24ea\u2466"}, {"id": "ref-for-relying-party\u2461\u24ea\u2467"}, {"id": "ref-for-relying-party\u2461\u24ea\u2468"}, {"id": "ref-for-relying-party\u2461\u2460\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2461"}, {"id": "ref-for-relying-party\u2461\u2460\u2462"}, {"id": "ref-for-relying-party\u2461\u2460\u2463"}, {"id": "ref-for-relying-party\u2461\u2460\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2465"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2466"}, {"id": "ref-for-relying-party\u2461\u2460\u2467"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2461\u2460"}, {"id": "ref-for-relying-party\u2461\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2461\u2463"}, {"id": "ref-for-relying-party\u2461\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2461\u2465"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2461\u2467"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2468"}, {"id": "ref-for-relying-party\u2461\u2462\u24ea"}, {"id": "ref-for-relying-party\u2461\u2462\u2460"}, {"id": "ref-for-relying-party\u2461\u2462\u2461"}, {"id": "ref-for-relying-party\u2461\u2462\u2462"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2463"}, {"id": "ref-for-relying-party\u2461\u2462\u2464"}, {"id": "ref-for-relying-party\u2461\u2462\u2465"}, {"id": "ref-for-relying-party\u2461\u2462\u2466"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2467"}, {"id": "ref-for-relying-party\u2461\u2462\u2468"}, {"id": "ref-for-relying-party\u2461\u2463\u24ea"}, {"id": "ref-for-relying-party\u2461\u2463\u2460"}, {"id": "ref-for-relying-party\u2461\u2463\u2461"}, {"id": "ref-for-relying-party\u2461\u2463\u2462"}, {"id": "ref-for-relying-party\u2461\u2463\u2463"}, {"id": "ref-for-relying-party\u2461\u2463\u2464"}, {"id": "ref-for-relying-party\u2461\u2463\u2465"}, {"id": "ref-for-relying-party\u2461\u2463\u2466"}, {"id": "ref-for-relying-party\u2461\u2463\u2467"}, {"id": "ref-for-relying-party\u2461\u2463\u2468"}, {"id": "ref-for-relying-party\u2461\u2464\u24ea"}, {"id": "ref-for-relying-party\u2461\u2464\u2460"}, {"id": "ref-for-relying-party\u2461\u2464\u2461"}, {"id": "ref-for-relying-party\u2461\u2464\u2462"}, {"id": "ref-for-relying-party\u2461\u2464\u2463"}, {"id": "ref-for-relying-party\u2461\u2464\u2464"}, {"id": "ref-for-relying-party\u2461\u2464\u2465"}, {"id": "ref-for-relying-party\u2461\u2464\u2466"}, {"id": "ref-for-relying-party\u2461\u2464\u2467"}, {"id": "ref-for-relying-party\u2461\u2464\u2468"}, {"id": "ref-for-relying-party\u2461\u2465\u24ea"}, {"id": "ref-for-relying-party\u2461\u2465\u2460"}, {"id": "ref-for-relying-party\u2461\u2465\u2461"}, {"id": "ref-for-relying-party\u2461\u2465\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2465\u2463"}, {"id": "ref-for-relying-party\u2461\u2465\u2464"}, {"id": "ref-for-relying-party\u2461\u2465\u2465"}, {"id": "ref-for-relying-party\u2461\u2465\u2466"}, {"id": "ref-for-relying-party\u2461\u2465\u2467"}, {"id": "ref-for-relying-party\u2461\u2465\u2468"}, {"id": "ref-for-relying-party\u2461\u2466\u24ea"}, {"id": "ref-for-relying-party\u2461\u2466\u2460"}, {"id": "ref-for-relying-party\u2461\u2466\u2461"}, {"id": "ref-for-relying-party\u2461\u2466\u2462"}, {"id": "ref-for-relying-party\u2461\u2466\u2463"}, {"id": "ref-for-relying-party\u2461\u2466\u2464"}, {"id": "ref-for-relying-party\u2461\u2466\u2465"}, {"id": "ref-for-relying-party\u2461\u2466\u2466"}, {"id": "ref-for-relying-party\u2461\u2466\u2467"}, {"id": "ref-for-relying-party\u2461\u2466\u2468"}, {"id": "ref-for-relying-party\u2461\u2467\u24ea"}, {"id": "ref-for-relying-party\u2461\u2467\u2460"}, {"id": "ref-for-relying-party\u2461\u2467\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2467\u2462"}, {"id": "ref-for-relying-party\u2461\u2467\u2463"}, {"id": "ref-for-relying-party\u2461\u2467\u2464"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2467\u2465"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2467\u2466"}, {"id": "ref-for-relying-party\u2461\u2467\u2467"}, {"id": "ref-for-relying-party\u2461\u2467\u2468"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u24ea"}, {"id": "ref-for-relying-party\u2461\u2468\u2460"}, {"id": "ref-for-relying-party\u2461\u2468\u2461"}, {"id": "ref-for-relying-party\u2461\u2468\u2462"}, {"id": "ref-for-relying-party\u2461\u2468\u2463"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2464"}, {"id": "ref-for-relying-party\u2461\u2468\u2465"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2466"}, {"id": "ref-for-relying-party\u2461\u2468\u2467"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2468"}, {"id": "ref-for-relying-party\u2462\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2462\u24ea\u2460"}, {"id": "ref-for-relying-party\u2462\u24ea\u2461"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2462"}, {"id": "ref-for-relying-party\u2462\u24ea\u2463"}, {"id": "ref-for-relying-party\u2462\u24ea\u2464"}, {"id": "ref-for-relying-party\u2462\u24ea\u2465"}, {"id": "ref-for-relying-party\u2462\u24ea\u2466"}, {"id": "ref-for-relying-party\u2462\u24ea\u2467"}, {"id": "ref-for-relying-party\u2462\u24ea\u2468"}, {"id": "ref-for-relying-party\u2462\u2460\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2461"}, {"id": "ref-for-relying-party\u2462\u2460\u2462"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2463"}, {"id": "ref-for-relying-party\u2462\u2460\u2464"}, {"id": "ref-for-relying-party\u2462\u2460\u2465"}, {"id": "ref-for-relying-party\u2462\u2460\u2466"}, {"id": "ref-for-relying-party\u2462\u2460\u2467"}, {"id": "ref-for-relying-party\u2462\u2460\u2468"}, {"id": "ref-for-relying-party\u2462\u2461\u24ea"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2460"}, {"id": "ref-for-relying-party\u2462\u2461\u2461"}, {"id": "ref-for-relying-party\u2462\u2461\u2462"}, {"id": "ref-for-relying-party\u2462\u2461\u2463"}, {"id": "ref-for-relying-party\u2462\u2461\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2465"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2466"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2467"}, {"id": "ref-for-relying-party\u2462\u2461\u2468"}, {"id": "ref-for-relying-party\u2462\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2462\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2461"}, {"id": "ref-for-relying-party\u2462\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2462\u2466"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2467"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2468"}, {"id": "ref-for-relying-party\u2462\u2463\u24ea"}, {"id": "ref-for-relying-party\u2462\u2463\u2460"}, {"id": "ref-for-relying-party\u2462\u2463\u2461"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2462"}, {"id": "ref-for-relying-party\u2462\u2463\u2463"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2464"}, {"id": "ref-for-relying-party\u2462\u2463\u2465"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2466"}], "title": "13.4. Security considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2467"}, {"id": "ref-for-relying-party\u2462\u2463\u2468"}, {"id": "ref-for-relying-party\u2462\u2464\u24ea"}, {"id": "ref-for-relying-party\u2462\u2464\u2460"}, {"id": "ref-for-relying-party\u2462\u2464\u2461"}, {"id": "ref-for-relying-party\u2462\u2464\u2462"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2463"}, {"id": "ref-for-relying-party\u2462\u2464\u2464"}, {"id": "ref-for-relying-party\u2462\u2464\u2465"}, {"id": "ref-for-relying-party\u2462\u2464\u2466"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2467"}, {"id": "ref-for-relying-party\u2462\u2464\u2468"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u24ea"}, {"id": "ref-for-relying-party\u2462\u2465\u2460"}, {"id": "ref-for-relying-party\u2462\u2465\u2461"}, {"id": "ref-for-relying-party\u2462\u2465\u2462"}, {"id": "ref-for-relying-party\u2462\u2465\u2463"}, {"id": "ref-for-relying-party\u2462\u2465\u2464"}, {"id": "ref-for-relying-party\u2462\u2465\u2465"}, {"id": "ref-for-relying-party\u2462\u2465\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2467"}, {"id": "ref-for-relying-party\u2462\u2465\u2468"}, {"id": "ref-for-relying-party\u2462\u2466\u24ea"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2460"}, {"id": "ref-for-relying-party\u2462\u2466\u2461"}, {"id": "ref-for-relying-party\u2462\u2466\u2462"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2463"}, {"id": "ref-for-relying-party\u2462\u2466\u2464"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2465"}, {"id": "ref-for-relying-party\u2462\u2466\u2466"}, {"id": "ref-for-relying-party\u2462\u2466\u2467"}, {"id": "ref-for-relying-party\u2462\u2466\u2468"}, {"id": "ref-for-relying-party\u2462\u2467\u24ea"}, {"id": "ref-for-relying-party\u2462\u2467\u2460"}, {"id": "ref-for-relying-party\u2462\u2467\u2461"}, {"id": "ref-for-relying-party\u2462\u2467\u2462"}, {"id": "ref-for-relying-party\u2462\u2467\u2463"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2464"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2465"}, {"id": "ref-for-relying-party\u2462\u2467\u2466"}, {"id": "ref-for-relying-party\u2462\u2467\u2467"}, {"id": "ref-for-relying-party\u2462\u2467\u2468"}, {"id": "ref-for-relying-party\u2462\u2468\u24ea"}, {"id": "ref-for-relying-party\u2462\u2468\u2460"}, {"id": "ref-for-relying-party\u2462\u2468\u2461"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2462"}, {"id": "ref-for-relying-party\u2462\u2468\u2463"}, {"id": "ref-for-relying-party\u2462\u2468\u2464"}, {"id": "ref-for-relying-party\u2462\u2468\u2465"}, {"id": "ref-for-relying-party\u2462\u2468\u2466"}, {"id": "ref-for-relying-party\u2462\u2468\u2467"}, {"id": "ref-for-relying-party\u2462\u2468\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2463\u24ea\u2460"}, {"id": "ref-for-relying-party\u2463\u24ea\u2461"}, {"id": "ref-for-relying-party\u2463\u24ea\u2462"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2463"}, {"id": "ref-for-relying-party\u2463\u24ea\u2464"}, {"id": "ref-for-relying-party\u2463\u24ea\u2465"}, {"id": "ref-for-relying-party\u2463\u24ea\u2466"}, {"id": "ref-for-relying-party\u2463\u24ea\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2468"}, {"id": "ref-for-relying-party\u2463\u2460\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460\u2460"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2461"}, {"id": "ref-for-relying-party\u2463\u2460\u2462"}, {"id": "ref-for-relying-party\u2463\u2460\u2463"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2464"}], "title": "14.6. Privacy considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2465"}, {"id": "ref-for-relying-party\u2463\u2460\u2466"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2467"}, {"id": "ref-for-relying-party\u2463\u2460\u2468"}, {"id": "ref-for-relying-party\u2463\u2461\u24ea"}, {"id": "ref-for-relying-party\u2463\u2461\u2460"}, {"id": "ref-for-relying-party\u2463\u2461\u2461"}, {"id": "ref-for-relying-party\u2463\u2461\u2462"}, {"id": "ref-for-relying-party\u2463\u2461\u2463"}, {"id": "ref-for-relying-party\u2463\u2461\u2464"}, {"id": "ref-for-relying-party\u2463\u2461\u2465"}, {"id": "ref-for-relying-party\u2463\u2461\u2466"}, {"id": "ref-for-relying-party\u2463\u2461\u2467"}, {"id": "ref-for-relying-party\u2463\u2461\u2468"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u24ea"}, {"id": "ref-for-relying-party\u2463\u2462\u2460"}, {"id": "ref-for-relying-party\u2463\u2462\u2461"}, {"id": "ref-for-relying-party\u2463\u2462\u2462"}, {"id": "ref-for-relying-party\u2463\u2462\u2463"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2464"}, {"id": "ref-for-relying-party\u2463\u2462\u2465"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['webauthn-relying-party'] = {"dfnID": "webauthn-relying-party", "url": "#webauthn-relying-party", "dfnText": "WebAuthn Relying Party", "refSections": [{"refs": [{"id": "ref-for-webauthn-relying-party\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464"}], "title": "2.3. WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2465"}, {"id": "ref-for-webauthn-relying-party\u2466"}, {"id": "ref-for-webauthn-relying-party\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2462"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2463"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2464"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2465"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2466"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2467"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2468"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u24ea"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2460"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2461"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2462"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2463"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2464"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2465"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2466"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2467"}, {"id": "ref-for-webauthn-relying-party\u2461\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u24ea"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2460"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2461"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2462"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2463"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2465"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2467"}], "title": "12.2. WebAuthn Attestation Statement Format Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2468"}, {"id": "ref-for-webauthn-relying-party\u2463\u24ea"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2460"}, {"id": "ref-for-webauthn-relying-party\u2463\u2461"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2462"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2463"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2464"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2465"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2467"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2468"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u24ea"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2460"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2461"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2462"}], "title": "14.6.2. Username Enumeration"}], "external": false};
+window.dfnpanelData['relying-party'] = {"dfnID": "relying-party", "url": "#relying-party", "dfnText": "Relying Party", "refSections": [{"refs": [{"id": "ref-for-relying-party\u2460"}, {"id": "ref-for-relying-party\u2461"}, {"id": "ref-for-relying-party\u2462"}, {"id": "ref-for-relying-party\u2463"}, {"id": "ref-for-relying-party\u2464"}, {"id": "ref-for-relying-party\u2465"}, {"id": "ref-for-relying-party\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-relying-party\u2467"}, {"id": "ref-for-relying-party\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2468"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2468"}, {"id": "ref-for-relying-party\u2464\u24ea"}, {"id": "ref-for-relying-party\u2464\u2460"}, {"id": "ref-for-relying-party\u2464\u2461"}, {"id": "ref-for-relying-party\u2464\u2462"}, {"id": "ref-for-relying-party\u2464\u2463"}, {"id": "ref-for-relying-party\u2464\u2464"}, {"id": "ref-for-relying-party\u2464\u2465"}, {"id": "ref-for-relying-party\u2464\u2466"}, {"id": "ref-for-relying-party\u2464\u2467"}, {"id": "ref-for-relying-party\u2464\u2468"}, {"id": "ref-for-relying-party\u2465\u24ea"}, {"id": "ref-for-relying-party\u2465\u2460"}, {"id": "ref-for-relying-party\u2465\u2461"}, {"id": "ref-for-relying-party\u2465\u2462"}, {"id": "ref-for-relying-party\u2465\u2463"}, {"id": "ref-for-relying-party\u2465\u2464"}, {"id": "ref-for-relying-party\u2465\u2465"}, {"id": "ref-for-relying-party\u2465\u2466"}, {"id": "ref-for-relying-party\u2465\u2467"}, {"id": "ref-for-relying-party\u2465\u2468"}, {"id": "ref-for-relying-party\u2466\u24ea"}, {"id": "ref-for-relying-party\u2466\u2460"}, {"id": "ref-for-relying-party\u2466\u2461"}, {"id": "ref-for-relying-party\u2466\u2462"}, {"id": "ref-for-relying-party\u2466\u2463"}, {"id": "ref-for-relying-party\u2466\u2464"}, {"id": "ref-for-relying-party\u2466\u2465"}, {"id": "ref-for-relying-party\u2466\u2466"}, {"id": "ref-for-relying-party\u2466\u2467"}, {"id": "ref-for-relying-party\u2466\u2468"}, {"id": "ref-for-relying-party\u2467\u24ea"}, {"id": "ref-for-relying-party\u2467\u2460"}, {"id": "ref-for-relying-party\u2467\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party\u2467\u2462"}, {"id": "ref-for-relying-party\u2467\u2463"}, {"id": "ref-for-relying-party\u2467\u2464"}, {"id": "ref-for-relying-party\u2467\u2465"}, {"id": "ref-for-relying-party\u2467\u2466"}, {"id": "ref-for-relying-party\u2467\u2467"}, {"id": "ref-for-relying-party\u2467\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party\u2468\u24ea"}, {"id": "ref-for-relying-party\u2468\u2460"}, {"id": "ref-for-relying-party\u2468\u2461"}, {"id": "ref-for-relying-party\u2468\u2462"}, {"id": "ref-for-relying-party\u2468\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2464"}, {"id": "ref-for-relying-party\u2468\u2465"}, {"id": "ref-for-relying-party\u2468\u2466"}, {"id": "ref-for-relying-party\u2468\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2460\u24ea\u2460"}, {"id": "ref-for-relying-party\u2460\u24ea\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2462"}, {"id": "ref-for-relying-party\u2460\u24ea\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2466"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2467"}, {"id": "ref-for-relying-party\u2460\u24ea\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2460\u2464"}, {"id": "ref-for-relying-party\u2460\u2460\u2465"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2466"}, {"id": "ref-for-relying-party\u2460\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2460\u2468"}, {"id": "ref-for-relying-party\u2460\u2461\u24ea"}, {"id": "ref-for-relying-party\u2460\u2461\u2460"}, {"id": "ref-for-relying-party\u2460\u2461\u2461"}, {"id": "ref-for-relying-party\u2460\u2461\u2462"}, {"id": "ref-for-relying-party\u2460\u2461\u2463"}, {"id": "ref-for-relying-party\u2460\u2461\u2464"}, {"id": "ref-for-relying-party\u2460\u2461\u2465"}, {"id": "ref-for-relying-party\u2460\u2461\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2461\u2467"}, {"id": "ref-for-relying-party\u2460\u2461\u2468"}, {"id": "ref-for-relying-party\u2460\u2462\u24ea"}, {"id": "ref-for-relying-party\u2460\u2462\u2460"}, {"id": "ref-for-relying-party\u2460\u2462\u2461"}, {"id": "ref-for-relying-party\u2460\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2463"}, {"id": "ref-for-relying-party\u2460\u2462\u2464"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2465"}, {"id": "ref-for-relying-party\u2460\u2462\u2466"}, {"id": "ref-for-relying-party\u2460\u2462\u2467"}, {"id": "ref-for-relying-party\u2460\u2462\u2468"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u24ea"}, {"id": "ref-for-relying-party\u2460\u2463\u2460"}, {"id": "ref-for-relying-party\u2460\u2463\u2461"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2462"}, {"id": "ref-for-relying-party\u2460\u2463\u2463"}, {"id": "ref-for-relying-party\u2460\u2463\u2464"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2465"}, {"id": "ref-for-relying-party\u2460\u2463\u2466"}, {"id": "ref-for-relying-party\u2460\u2463\u2467"}, {"id": "ref-for-relying-party\u2460\u2463\u2468"}, {"id": "ref-for-relying-party\u2460\u2464\u24ea"}, {"id": "ref-for-relying-party\u2460\u2464\u2460"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2461"}, {"id": "ref-for-relying-party\u2460\u2464\u2462"}, {"id": "ref-for-relying-party\u2460\u2464\u2463"}, {"id": "ref-for-relying-party\u2460\u2464\u2464"}, {"id": "ref-for-relying-party\u2460\u2464\u2465"}, {"id": "ref-for-relying-party\u2460\u2464\u2466"}, {"id": "ref-for-relying-party\u2460\u2464\u2467"}, {"id": "ref-for-relying-party\u2460\u2464\u2468"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465\u24ea"}, {"id": "ref-for-relying-party\u2460\u2465\u2460"}, {"id": "ref-for-relying-party\u2460\u2465\u2461"}, {"id": "ref-for-relying-party\u2460\u2465\u2462"}, {"id": "ref-for-relying-party\u2460\u2465\u2463"}, {"id": "ref-for-relying-party\u2460\u2465\u2464"}, {"id": "ref-for-relying-party\u2460\u2465\u2465"}, {"id": "ref-for-relying-party\u2460\u2465\u2466"}, {"id": "ref-for-relying-party\u2460\u2465\u2467"}, {"id": "ref-for-relying-party\u2460\u2465\u2468"}, {"id": "ref-for-relying-party\u2460\u2466\u24ea"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2460"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2461"}, {"id": "ref-for-relying-party\u2460\u2466\u2462"}, {"id": "ref-for-relying-party\u2460\u2466\u2463"}, {"id": "ref-for-relying-party\u2460\u2466\u2464"}, {"id": "ref-for-relying-party\u2460\u2466\u2465"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2466"}, {"id": "ref-for-relying-party\u2460\u2466\u2467"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2468"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u24ea"}, {"id": "ref-for-relying-party\u2460\u2467\u2460"}, {"id": "ref-for-relying-party\u2460\u2467\u2461"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2462"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2463"}, {"id": "ref-for-relying-party\u2460\u2467\u2464"}, {"id": "ref-for-relying-party\u2460\u2467\u2465"}, {"id": "ref-for-relying-party\u2460\u2467\u2466"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2467"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2468"}, {"id": "ref-for-relying-party\u2460\u2468\u24ea"}, {"id": "ref-for-relying-party\u2460\u2468\u2460"}, {"id": "ref-for-relying-party\u2460\u2468\u2461"}, {"id": "ref-for-relying-party\u2460\u2468\u2462"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2463"}, {"id": "ref-for-relying-party\u2460\u2468\u2464"}, {"id": "ref-for-relying-party\u2460\u2468\u2465"}, {"id": "ref-for-relying-party\u2460\u2468\u2466"}, {"id": "ref-for-relying-party\u2460\u2468\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2468"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2461\u24ea\u2460"}, {"id": "ref-for-relying-party\u2461\u24ea\u2461"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2462"}, {"id": "ref-for-relying-party\u2461\u24ea\u2463"}, {"id": "ref-for-relying-party\u2461\u24ea\u2464"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2465"}, {"id": "ref-for-relying-party\u2461\u24ea\u2466"}, {"id": "ref-for-relying-party\u2461\u24ea\u2467"}, {"id": "ref-for-relying-party\u2461\u24ea\u2468"}, {"id": "ref-for-relying-party\u2461\u2460\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460\u2460"}, {"id": "ref-for-relying-party\u2461\u2460\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2462"}, {"id": "ref-for-relying-party\u2461\u2460\u2463"}, {"id": "ref-for-relying-party\u2461\u2460\u2464"}, {"id": "ref-for-relying-party\u2461\u2460\u2465"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2466"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2467"}, {"id": "ref-for-relying-party\u2461\u2460\u2468"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2461\u2460"}, {"id": "ref-for-relying-party\u2461\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2461\u2463"}, {"id": "ref-for-relying-party\u2461\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2461\u2466"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2461\u2468"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u24ea"}, {"id": "ref-for-relying-party\u2461\u2462\u2460"}, {"id": "ref-for-relying-party\u2461\u2462\u2461"}, {"id": "ref-for-relying-party\u2461\u2462\u2462"}, {"id": "ref-for-relying-party\u2461\u2462\u2463"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2464"}, {"id": "ref-for-relying-party\u2461\u2462\u2465"}, {"id": "ref-for-relying-party\u2461\u2462\u2466"}, {"id": "ref-for-relying-party\u2461\u2462\u2467"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2468"}, {"id": "ref-for-relying-party\u2461\u2463\u24ea"}, {"id": "ref-for-relying-party\u2461\u2463\u2460"}, {"id": "ref-for-relying-party\u2461\u2463\u2461"}, {"id": "ref-for-relying-party\u2461\u2463\u2462"}, {"id": "ref-for-relying-party\u2461\u2463\u2463"}, {"id": "ref-for-relying-party\u2461\u2463\u2464"}, {"id": "ref-for-relying-party\u2461\u2463\u2465"}, {"id": "ref-for-relying-party\u2461\u2463\u2466"}, {"id": "ref-for-relying-party\u2461\u2463\u2467"}, {"id": "ref-for-relying-party\u2461\u2463\u2468"}, {"id": "ref-for-relying-party\u2461\u2464\u24ea"}, {"id": "ref-for-relying-party\u2461\u2464\u2460"}, {"id": "ref-for-relying-party\u2461\u2464\u2461"}, {"id": "ref-for-relying-party\u2461\u2464\u2462"}, {"id": "ref-for-relying-party\u2461\u2464\u2463"}, {"id": "ref-for-relying-party\u2461\u2464\u2464"}, {"id": "ref-for-relying-party\u2461\u2464\u2465"}, {"id": "ref-for-relying-party\u2461\u2464\u2466"}, {"id": "ref-for-relying-party\u2461\u2464\u2467"}, {"id": "ref-for-relying-party\u2461\u2464\u2468"}, {"id": "ref-for-relying-party\u2461\u2465\u24ea"}, {"id": "ref-for-relying-party\u2461\u2465\u2460"}, {"id": "ref-for-relying-party\u2461\u2465\u2461"}, {"id": "ref-for-relying-party\u2461\u2465\u2462"}, {"id": "ref-for-relying-party\u2461\u2465\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2465\u2464"}, {"id": "ref-for-relying-party\u2461\u2465\u2465"}, {"id": "ref-for-relying-party\u2461\u2465\u2466"}, {"id": "ref-for-relying-party\u2461\u2465\u2467"}, {"id": "ref-for-relying-party\u2461\u2465\u2468"}, {"id": "ref-for-relying-party\u2461\u2466\u24ea"}, {"id": "ref-for-relying-party\u2461\u2466\u2460"}, {"id": "ref-for-relying-party\u2461\u2466\u2461"}, {"id": "ref-for-relying-party\u2461\u2466\u2462"}, {"id": "ref-for-relying-party\u2461\u2466\u2463"}, {"id": "ref-for-relying-party\u2461\u2466\u2464"}, {"id": "ref-for-relying-party\u2461\u2466\u2465"}, {"id": "ref-for-relying-party\u2461\u2466\u2466"}, {"id": "ref-for-relying-party\u2461\u2466\u2467"}, {"id": "ref-for-relying-party\u2461\u2466\u2468"}, {"id": "ref-for-relying-party\u2461\u2467\u24ea"}, {"id": "ref-for-relying-party\u2461\u2467\u2460"}, {"id": "ref-for-relying-party\u2461\u2467\u2461"}, {"id": "ref-for-relying-party\u2461\u2467\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2467\u2463"}, {"id": "ref-for-relying-party\u2461\u2467\u2464"}, {"id": "ref-for-relying-party\u2461\u2467\u2465"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2467\u2466"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2467\u2467"}, {"id": "ref-for-relying-party\u2461\u2467\u2468"}, {"id": "ref-for-relying-party\u2461\u2468\u24ea"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2460"}, {"id": "ref-for-relying-party\u2461\u2468\u2461"}, {"id": "ref-for-relying-party\u2461\u2468\u2462"}, {"id": "ref-for-relying-party\u2461\u2468\u2463"}, {"id": "ref-for-relying-party\u2461\u2468\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2465"}, {"id": "ref-for-relying-party\u2461\u2468\u2466"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2467"}, {"id": "ref-for-relying-party\u2461\u2468\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2462\u24ea\u2460"}, {"id": "ref-for-relying-party\u2462\u24ea\u2461"}, {"id": "ref-for-relying-party\u2462\u24ea\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2463"}, {"id": "ref-for-relying-party\u2462\u24ea\u2464"}, {"id": "ref-for-relying-party\u2462\u24ea\u2465"}, {"id": "ref-for-relying-party\u2462\u24ea\u2466"}, {"id": "ref-for-relying-party\u2462\u24ea\u2467"}, {"id": "ref-for-relying-party\u2462\u24ea\u2468"}, {"id": "ref-for-relying-party\u2462\u2460\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460\u2460"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2461"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2462"}, {"id": "ref-for-relying-party\u2462\u2460\u2463"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2464"}, {"id": "ref-for-relying-party\u2462\u2460\u2465"}, {"id": "ref-for-relying-party\u2462\u2460\u2466"}, {"id": "ref-for-relying-party\u2462\u2460\u2467"}, {"id": "ref-for-relying-party\u2462\u2460\u2468"}, {"id": "ref-for-relying-party\u2462\u2461\u24ea"}, {"id": "ref-for-relying-party\u2462\u2461\u2460"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2461"}, {"id": "ref-for-relying-party\u2462\u2461\u2462"}, {"id": "ref-for-relying-party\u2462\u2461\u2463"}, {"id": "ref-for-relying-party\u2462\u2461\u2464"}, {"id": "ref-for-relying-party\u2462\u2461\u2465"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2466"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2467"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2468"}, {"id": "ref-for-relying-party\u2462\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2462\u2460"}, {"id": "ref-for-relying-party\u2462\u2462\u2461"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2462\u2467"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2468"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u24ea"}, {"id": "ref-for-relying-party\u2462\u2463\u2460"}, {"id": "ref-for-relying-party\u2462\u2463\u2461"}, {"id": "ref-for-relying-party\u2462\u2463\u2462"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2463"}, {"id": "ref-for-relying-party\u2462\u2463\u2464"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2465"}, {"id": "ref-for-relying-party\u2462\u2463\u2466"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2467"}], "title": "13.4. Security considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2468"}, {"id": "ref-for-relying-party\u2462\u2464\u24ea"}, {"id": "ref-for-relying-party\u2462\u2464\u2460"}, {"id": "ref-for-relying-party\u2462\u2464\u2461"}, {"id": "ref-for-relying-party\u2462\u2464\u2462"}, {"id": "ref-for-relying-party\u2462\u2464\u2463"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2464"}, {"id": "ref-for-relying-party\u2462\u2464\u2465"}, {"id": "ref-for-relying-party\u2462\u2464\u2466"}, {"id": "ref-for-relying-party\u2462\u2464\u2467"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2468"}, {"id": "ref-for-relying-party\u2462\u2465\u24ea"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2460"}, {"id": "ref-for-relying-party\u2462\u2465\u2461"}, {"id": "ref-for-relying-party\u2462\u2465\u2462"}, {"id": "ref-for-relying-party\u2462\u2465\u2463"}, {"id": "ref-for-relying-party\u2462\u2465\u2464"}, {"id": "ref-for-relying-party\u2462\u2465\u2465"}, {"id": "ref-for-relying-party\u2462\u2465\u2466"}, {"id": "ref-for-relying-party\u2462\u2465\u2467"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2468"}, {"id": "ref-for-relying-party\u2462\u2466\u24ea"}, {"id": "ref-for-relying-party\u2462\u2466\u2460"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2461"}, {"id": "ref-for-relying-party\u2462\u2466\u2462"}, {"id": "ref-for-relying-party\u2462\u2466\u2463"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2464"}, {"id": "ref-for-relying-party\u2462\u2466\u2465"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2466"}, {"id": "ref-for-relying-party\u2462\u2466\u2467"}, {"id": "ref-for-relying-party\u2462\u2466\u2468"}, {"id": "ref-for-relying-party\u2462\u2467\u24ea"}, {"id": "ref-for-relying-party\u2462\u2467\u2460"}, {"id": "ref-for-relying-party\u2462\u2467\u2461"}, {"id": "ref-for-relying-party\u2462\u2467\u2462"}, {"id": "ref-for-relying-party\u2462\u2467\u2463"}, {"id": "ref-for-relying-party\u2462\u2467\u2464"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2465"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2466"}, {"id": "ref-for-relying-party\u2462\u2467\u2467"}, {"id": "ref-for-relying-party\u2462\u2467\u2468"}, {"id": "ref-for-relying-party\u2462\u2468\u24ea"}, {"id": "ref-for-relying-party\u2462\u2468\u2460"}, {"id": "ref-for-relying-party\u2462\u2468\u2461"}, {"id": "ref-for-relying-party\u2462\u2468\u2462"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2463"}, {"id": "ref-for-relying-party\u2462\u2468\u2464"}, {"id": "ref-for-relying-party\u2462\u2468\u2465"}, {"id": "ref-for-relying-party\u2462\u2468\u2466"}, {"id": "ref-for-relying-party\u2462\u2468\u2467"}, {"id": "ref-for-relying-party\u2462\u2468\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2463\u24ea\u2460"}, {"id": "ref-for-relying-party\u2463\u24ea\u2461"}, {"id": "ref-for-relying-party\u2463\u24ea\u2462"}, {"id": "ref-for-relying-party\u2463\u24ea\u2463"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2464"}, {"id": "ref-for-relying-party\u2463\u24ea\u2465"}, {"id": "ref-for-relying-party\u2463\u24ea\u2466"}, {"id": "ref-for-relying-party\u2463\u24ea\u2467"}, {"id": "ref-for-relying-party\u2463\u24ea\u2468"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460\u2460"}, {"id": "ref-for-relying-party\u2463\u2460\u2461"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2462"}, {"id": "ref-for-relying-party\u2463\u2460\u2463"}, {"id": "ref-for-relying-party\u2463\u2460\u2464"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2465"}], "title": "14.6. Privacy considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2466"}, {"id": "ref-for-relying-party\u2463\u2460\u2467"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2468"}, {"id": "ref-for-relying-party\u2463\u2461\u24ea"}, {"id": "ref-for-relying-party\u2463\u2461\u2460"}, {"id": "ref-for-relying-party\u2463\u2461\u2461"}, {"id": "ref-for-relying-party\u2463\u2461\u2462"}, {"id": "ref-for-relying-party\u2463\u2461\u2463"}, {"id": "ref-for-relying-party\u2463\u2461\u2464"}, {"id": "ref-for-relying-party\u2463\u2461\u2465"}, {"id": "ref-for-relying-party\u2463\u2461\u2466"}, {"id": "ref-for-relying-party\u2463\u2461\u2467"}, {"id": "ref-for-relying-party\u2463\u2461\u2468"}, {"id": "ref-for-relying-party\u2463\u2462\u24ea"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2460"}, {"id": "ref-for-relying-party\u2463\u2462\u2461"}, {"id": "ref-for-relying-party\u2463\u2462\u2462"}, {"id": "ref-for-relying-party\u2463\u2462\u2463"}, {"id": "ref-for-relying-party\u2463\u2462\u2464"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2465"}, {"id": "ref-for-relying-party\u2463\u2462\u2466"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['webauthn-relying-party'] = {"dfnID": "webauthn-relying-party", "url": "#webauthn-relying-party", "dfnText": "WebAuthn Relying Party", "refSections": [{"refs": [{"id": "ref-for-webauthn-relying-party\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464"}], "title": "2.3. WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2465"}, {"id": "ref-for-webauthn-relying-party\u2466"}, {"id": "ref-for-webauthn-relying-party\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2462"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2463"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2465"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2466"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2468"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u24ea"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2462"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2463"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2465"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2466"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2467"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2468"}, {"id": "ref-for-webauthn-relying-party\u2462\u24ea"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2461"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2462"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2464"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2465"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2466"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2467"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2468"}], "title": "12.2. WebAuthn Attestation Statement Format Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u24ea"}, {"id": "ref-for-webauthn-relying-party\u2463\u2460"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2461"}, {"id": "ref-for-webauthn-relying-party\u2463\u2462"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2463"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2464"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2465"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2466"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2467"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2468"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u24ea"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2460"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2461"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2462"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2463"}], "title": "14.6.2. Username Enumeration"}], "external": false};
 window.dfnpanelData['web-application'] = {"dfnID": "web-application", "url": "#web-application", "dfnText": "web application", "refSections": [{"refs": [{"id": "ref-for-web-application\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-web-application\u2461"}, {"id": "ref-for-web-application\u2462"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-web-application\u2463"}], "title": "11. User Agent Automation"}, {"refs": [{"id": "ref-for-web-application\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-web-application\u2465"}], "title": "13. Security Considerations"}], "external": false};
 window.dfnpanelData['relying-party-identifier'] = {"dfnID": "relying-party-identifier", "url": "#relying-party-identifier", "dfnText": "Relying Party Identifier", "refSections": [{"refs": [{"id": "ref-for-relying-party-identifier"}, {"id": "ref-for-relying-party-identifier\u2460"}, {"id": "ref-for-relying-party-identifier\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party-identifier\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party-identifier\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": false};
 window.dfnpanelData['rp-id'] = {"dfnID": "rp-id", "url": "#rp-id", "dfnText": "RP ID", "refSections": [{"refs": [{"id": "ref-for-rp-id"}, {"id": "ref-for-rp-id\u2460"}, {"id": "ref-for-rp-id\u2461"}, {"id": "ref-for-rp-id\u2462"}, {"id": "ref-for-rp-id\u2463"}, {"id": "ref-for-rp-id\u2464"}, {"id": "ref-for-rp-id\u2465"}, {"id": "ref-for-rp-id\u2466"}, {"id": "ref-for-rp-id\u2467"}, {"id": "ref-for-rp-id\u2468"}, {"id": "ref-for-rp-id\u2460\u24ea"}, {"id": "ref-for-rp-id\u2460\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-rp-id\u2460\u2461"}, {"id": "ref-for-rp-id\u2460\u2462"}, {"id": "ref-for-rp-id\u2460\u2463"}, {"id": "ref-for-rp-id\u2460\u2464"}, {"id": "ref-for-rp-id\u2460\u2465"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-rp-id\u2460\u2466"}, {"id": "ref-for-rp-id\u2460\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-rp-id\u2460\u2468"}, {"id": "ref-for-rp-id\u2461\u24ea"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-rp-id\u2461\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-rp-id\u2461\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-rp-id\u2461\u2462"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-rp-id\u2461\u2463"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-rp-id\u2461\u2464"}, {"id": "ref-for-rp-id\u2461\u2465"}, {"id": "ref-for-rp-id\u2461\u2466"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-rp-id\u2461\u2467"}, {"id": "ref-for-rp-id\u2461\u2468"}, {"id": "ref-for-rp-id\u2462\u24ea"}, {"id": "ref-for-rp-id\u2462\u2460"}, {"id": "ref-for-rp-id\u2462\u2461"}, {"id": "ref-for-rp-id\u2462\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-rp-id\u2462\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-rp-id\u2462\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-rp-id\u2462\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-rp-id\u2462\u2466"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-rp-id\u2462\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-rp-id\u2462\u2468"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-rp-id\u2463\u24ea"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-rp-id\u2463\u2460"}, {"id": "ref-for-rp-id\u2463\u2461"}, {"id": "ref-for-rp-id\u2463\u2462"}, {"id": "ref-for-rp-id\u2463\u2463"}, {"id": "ref-for-rp-id\u2463\u2464"}, {"id": "ref-for-rp-id\u2463\u2465"}, {"id": "ref-for-rp-id\u2463\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-rp-id\u2463\u2467"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-rp-id\u2463\u2468"}], "title": "11.5. Add Credential"}, {"refs": [{"id": "ref-for-rp-id\u2464\u24ea"}, {"id": "ref-for-rp-id\u2464\u2460"}], "title": "13.4.8. Code injection attacks"}], "external": false};
@@ -11046,15 +11072,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['concept-user-present'] = {"dfnID": "concept-user-present", "url": "#concept-user-present", "dfnText": "User Present", "refSections": [{"refs": [{"id": "ref-for-concept-user-present"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-user-present\u2460"}, {"id": "ref-for-concept-user-present\u2461"}, {"id": "ref-for-concept-user-present\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-concept-user-present\u2463"}], "title": "13.2. Physical Proximity between Client and Authenticator"}], "external": false};
 window.dfnpanelData['user-verification'] = {"dfnID": "user-verification", "url": "#user-verification", "dfnText": "User Verification", "refSections": [{"refs": [{"id": "ref-for-user-verification"}, {"id": "ref-for-user-verification\u2460"}, {"id": "ref-for-user-verification\u2461"}, {"id": "ref-for-user-verification\u2462"}, {"id": "ref-for-user-verification\u2463"}, {"id": "ref-for-user-verification\u2464"}, {"id": "ref-for-user-verification\u2465"}, {"id": "ref-for-user-verification\u2466"}, {"id": "ref-for-user-verification\u2467"}, {"id": "ref-for-user-verification\u2468"}, {"id": "ref-for-user-verification\u2460\u24ea"}, {"id": "ref-for-user-verification\u2460\u2460"}, {"id": "ref-for-user-verification\u2460\u2461"}, {"id": "ref-for-user-verification\u2460\u2462"}, {"id": "ref-for-user-verification\u2460\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-user-verification\u2460\u2464"}, {"id": "ref-for-user-verification\u2460\u2465"}, {"id": "ref-for-user-verification\u2460\u2466"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-user-verification\u2460\u2467"}, {"id": "ref-for-user-verification\u2460\u2468"}, {"id": "ref-for-user-verification\u2461\u24ea"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-user-verification\u2461\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-user-verification\u2461\u2461"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-user-verification\u2461\u2462"}, {"id": "ref-for-user-verification\u2461\u2463"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-user-verification\u2461\u2464"}, {"id": "ref-for-user-verification\u2461\u2465"}, {"id": "ref-for-user-verification\u2461\u2466"}, {"id": "ref-for-user-verification\u2461\u2467"}, {"id": "ref-for-user-verification\u2461\u2468"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-user-verification\u2462\u24ea"}, {"id": "ref-for-user-verification\u2462\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-user-verification\u2462\u2461"}, {"id": "ref-for-user-verification\u2462\u2462"}, {"id": "ref-for-user-verification\u2462\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-user-verification\u2462\u2464"}, {"id": "ref-for-user-verification\u2462\u2465"}, {"id": "ref-for-user-verification\u2462\u2466"}, {"id": "ref-for-user-verification\u2462\u2467"}, {"id": "ref-for-user-verification\u2462\u2468"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-user-verification\u2463\u24ea"}, {"id": "ref-for-user-verification\u2463\u2460"}, {"id": "ref-for-user-verification\u2463\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-user-verification\u2463\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-user-verification\u2463\u2463"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-user-verification\u2463\u2464"}, {"id": "ref-for-user-verification\u2463\u2465"}, {"id": "ref-for-user-verification\u2463\u2466"}, {"id": "ref-for-user-verification\u2463\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-user-verification\u2463\u2468"}, {"id": "ref-for-user-verification\u2464\u24ea"}, {"id": "ref-for-user-verification\u2464\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-user-verification\u2464\u2461"}, {"id": "ref-for-user-verification\u2464\u2462"}, {"id": "ref-for-user-verification\u2464\u2463"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-user-verification\u2464\u2464"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-user-verification\u2464\u2465"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-user-verification\u2464\u2466"}, {"id": "ref-for-user-verification\u2464\u2467"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-user-verification\u2464\u2468"}, {"id": "ref-for-user-verification\u2465\u24ea"}, {"id": "ref-for-user-verification\u2465\u2460"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}, {"refs": [{"id": "ref-for-user-verification\u2465\u2461"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-user-verification\u2465\u2462"}], "title": "15. Accessibility Considerations"}], "external": false};
 window.dfnpanelData['concept-user-verified'] = {"dfnID": "concept-user-verified", "url": "#concept-user-verified", "dfnText": "User Verified", "refSections": [{"refs": [{"id": "ref-for-concept-user-verified"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-concept-user-verified\u2460"}, {"id": "ref-for-concept-user-verified\u2461"}, {"id": "ref-for-concept-user-verified\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-concept-user-verified\u2463"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": false};
-window.dfnpanelData['web-authentication-api'] = {"dfnID": "web-authentication-api", "url": "#web-authentication-api", "dfnText": "Web Authentication API", "refSections": [{"refs": [{"id": "ref-for-web-authentication-api"}, {"id": "ref-for-web-authentication-api\u2460"}, {"id": "ref-for-web-authentication-api\u2461"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-web-authentication-api\u2462"}, {"id": "ref-for-web-authentication-api\u2463"}, {"id": "ref-for-web-authentication-api\u2464"}, {"id": "ref-for-web-authentication-api\u2465"}, {"id": "ref-for-web-authentication-api\u2466"}, {"id": "ref-for-web-authentication-api\u2467"}, {"id": "ref-for-web-authentication-api\u2468"}, {"id": "ref-for-web-authentication-api\u2460\u24ea"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2461"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2462"}, {"id": "ref-for-web-authentication-api\u2460\u2463"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2464"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2465"}, {"id": "ref-for-web-authentication-api\u2460\u2466"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
-window.dfnpanelData['publickeycredential'] = {"dfnID": "publickeycredential", "url": "#publickeycredential", "dfnText": "PublicKeyCredential", "refSections": [{"refs": [{"id": "ref-for-publickeycredential"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-publickeycredential\u2460"}, {"id": "ref-for-publickeycredential\u2461"}, {"id": "ref-for-publickeycredential\u2462"}, {"id": "ref-for-publickeycredential\u2463"}, {"id": "ref-for-publickeycredential\u2464"}, {"id": "ref-for-publickeycredential\u2465"}, {"id": "ref-for-publickeycredential\u2466"}, {"id": "ref-for-publickeycredential\u2467"}, {"id": "ref-for-publickeycredential\u2468"}, {"id": "ref-for-publickeycredential\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2460"}, {"id": "ref-for-publickeycredential\u2460\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2463"}, {"id": "ref-for-publickeycredential\u2460\u2464"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2465"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2466"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2467"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2468"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u24ea"}, {"id": "ref-for-publickeycredential\u2461\u2460"}, {"id": "ref-for-publickeycredential\u2461\u2461"}, {"id": "ref-for-publickeycredential\u2461\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2463"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2464"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2465"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
+window.dfnpanelData['web-authentication-api'] = {"dfnID": "web-authentication-api", "url": "#web-authentication-api", "dfnText": "Web Authentication API", "refSections": [{"refs": [{"id": "ref-for-web-authentication-api"}, {"id": "ref-for-web-authentication-api\u2460"}, {"id": "ref-for-web-authentication-api\u2461"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-web-authentication-api\u2462"}, {"id": "ref-for-web-authentication-api\u2463"}, {"id": "ref-for-web-authentication-api\u2464"}, {"id": "ref-for-web-authentication-api\u2465"}, {"id": "ref-for-web-authentication-api\u2466"}, {"id": "ref-for-web-authentication-api\u2467"}, {"id": "ref-for-web-authentication-api\u2468"}, {"id": "ref-for-web-authentication-api\u2460\u24ea"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2460"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2461"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2462"}], "title": "5.9. Permissions Policy integration"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2463"}, {"id": "ref-for-web-authentication-api\u2460\u2464"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2465"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-web-authentication-api\u2460\u2466"}, {"id": "ref-for-web-authentication-api\u2460\u2467"}], "title": "14.1. De-anonymization Prevention Measures"}], "external": false};
+window.dfnpanelData['publickeycredential'] = {"dfnID": "publickeycredential", "url": "#publickeycredential", "dfnText": "PublicKeyCredential", "refSections": [{"refs": [{"id": "ref-for-publickeycredential"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-publickeycredential\u2460"}, {"id": "ref-for-publickeycredential\u2461"}, {"id": "ref-for-publickeycredential\u2462"}, {"id": "ref-for-publickeycredential\u2463"}, {"id": "ref-for-publickeycredential\u2464"}, {"id": "ref-for-publickeycredential\u2465"}, {"id": "ref-for-publickeycredential\u2466"}, {"id": "ref-for-publickeycredential\u2467"}, {"id": "ref-for-publickeycredential\u2468"}, {"id": "ref-for-publickeycredential\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2460"}, {"id": "ref-for-publickeycredential\u2460\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2463"}, {"id": "ref-for-publickeycredential\u2460\u2464"}], "title": "5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2465"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2466"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2467"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-publickeycredential\u2460\u2468"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u24ea"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2460"}, {"id": "ref-for-publickeycredential\u2461\u2461"}, {"id": "ref-for-publickeycredential\u2461\u2462"}, {"id": "ref-for-publickeycredential\u2461\u2463"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2464"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2465"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-publickeycredential\u2461\u2466"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-rawid'] = {"dfnID": "dom-publickeycredential-rawid", "url": "#dom-publickeycredential-rawid", "dfnText": "rawId", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-rawid"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-rawid\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredential-rawid\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredential-rawid\u2462"}, {"id": "ref-for-dom-publickeycredential-rawid\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredential-rawid\u2464"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-getclientextensionresults'] = {"dfnID": "dom-publickeycredential-getclientextensionresults", "url": "#dom-publickeycredential-getclientextensionresults", "dfnText": "getClientExtensionResults", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-getclientextensionresults"}, {"id": "ref-for-dom-publickeycredential-getclientextensionresults\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-getclientextensionresults\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredential-getclientextensionresults\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredential-getclientextensionresults\u2463"}], "title": "9.4. Client Extension Processing"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-isconditionalmediationavailable'] = {"dfnID": "dom-publickeycredential-isconditionalmediationavailable", "url": "#dom-publickeycredential-isconditionalmediationavailable", "dfnText": "isConditionalMediationAvailable", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-isconditionalmediationavailable"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-isconditionalmediationavailable\u2460"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-tojson'] = {"dfnID": "dom-publickeycredential-tojson", "url": "#dom-publickeycredential-tojson", "dfnText": "toJSON", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-tojson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-response'] = {"dfnID": "dom-publickeycredential-response", "url": "#dom-publickeycredential-response", "dfnText": "response", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-response"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredential-response\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-response\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-response\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-response\u2463"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredential-response\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredential-response\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-authenticatorattachment'] = {"dfnID": "dom-publickeycredential-authenticatorattachment", "url": "#dom-publickeycredential-authenticatorattachment", "dfnText": "authenticatorAttachment", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment"}, {"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredential-authenticatorattachment\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}], "external": false};
-window.dfnpanelData['typedefdef-base64urlstring'] = {"dfnID": "typedefdef-base64urlstring", "url": "#typedefdef-base64urlstring", "dfnText": "Base64URLString", "refSections": [{"refs": [{"id": "ref-for-typedefdef-base64urlstring"}, {"id": "ref-for-typedefdef-base64urlstring\u2460"}, {"id": "ref-for-typedefdef-base64urlstring\u2461"}, {"id": "ref-for-typedefdef-base64urlstring\u2462"}, {"id": "ref-for-typedefdef-base64urlstring\u2463"}, {"id": "ref-for-typedefdef-base64urlstring\u2464"}, {"id": "ref-for-typedefdef-base64urlstring\u2465"}, {"id": "ref-for-typedefdef-base64urlstring\u2466"}, {"id": "ref-for-typedefdef-base64urlstring\u2467"}, {"id": "ref-for-typedefdef-base64urlstring\u2468"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u24ea"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-typedefdef-base64urlstring\u2460\u2461"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2462"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2463"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-typedefdef-base64urlstring\u2460\u2464"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
+window.dfnpanelData['typedefdef-base64urlstring'] = {"dfnID": "typedefdef-base64urlstring", "url": "#typedefdef-base64urlstring", "dfnText": "Base64URLString", "refSections": [{"refs": [{"id": "ref-for-typedefdef-base64urlstring"}, {"id": "ref-for-typedefdef-base64urlstring\u2460"}, {"id": "ref-for-typedefdef-base64urlstring\u2461"}, {"id": "ref-for-typedefdef-base64urlstring\u2462"}, {"id": "ref-for-typedefdef-base64urlstring\u2463"}, {"id": "ref-for-typedefdef-base64urlstring\u2464"}, {"id": "ref-for-typedefdef-base64urlstring\u2465"}, {"id": "ref-for-typedefdef-base64urlstring\u2466"}, {"id": "ref-for-typedefdef-base64urlstring\u2467"}, {"id": "ref-for-typedefdef-base64urlstring\u2468"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u24ea"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-typedefdef-base64urlstring\u2460\u2461"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2462"}, {"id": "ref-for-typedefdef-base64urlstring\u2460\u2463"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-typedefdef-base64urlstring\u2460\u2464"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
 window.dfnpanelData['typedefdef-publickeycredentialjson'] = {"dfnID": "typedefdef-publickeycredentialjson", "url": "#typedefdef-publickeycredentialjson", "dfnText": "PublicKeyCredentialJSON", "refSections": [{"refs": [{"id": "ref-for-typedefdef-publickeycredentialjson"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dictdef-registrationresponsejson'] = {"dfnID": "dictdef-registrationresponsejson", "url": "#dictdef-registrationresponsejson", "dfnText": "RegistrationResponseJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-registrationresponsejson"}, {"id": "ref-for-dictdef-registrationresponsejson\u2460"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
 window.dfnpanelData['dom-registrationresponsejson-clientextensionresults'] = {"dfnID": "dom-registrationresponsejson-clientextensionresults", "url": "#dom-registrationresponsejson-clientextensionresults", "dfnText": "clientExtensionResults", "refSections": [{"refs": [{"id": "ref-for-dom-registrationresponsejson-clientextensionresults"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
@@ -11095,13 +11121,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['publickeycredential-issuing-a-credential-request-to-an-authenticator'] = {"dfnID": "publickeycredential-issuing-a-credential-request-to-an-authenticator", "url": "#publickeycredential-issuing-a-credential-request-to-an-authenticator", "dfnText": "Issuing a Credential Request to an Authenticator", "refSections": [{"refs": [{"id": "ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator"}, {"id": "ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}], "external": false};
 window.dfnpanelData['effective-user-verification-requirement-for-assertion'] = {"dfnID": "effective-user-verification-requirement-for-assertion", "url": "#effective-user-verification-requirement-for-assertion", "dfnText": "effective user verification requirement for assertion", "refSections": [{"refs": [{"id": "ref-for-effective-user-verification-requirement-for-assertion"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": false};
 window.dfnpanelData['dom-publickeycredential-isuserverifyingplatformauthenticatoravailable'] = {"dfnID": "dom-publickeycredential-isuserverifyingplatformauthenticatoravailable", "url": "#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable", "dfnText": "isUserVerifyingPlatformAuthenticatorAvailable", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"}], "title": "5.1. PublicKeyCredential Interface"}], "external": false};
-window.dfnpanelData['dom-publickeycredential-parsecreationoptionsfromjson-options-options'] = {"dfnID": "dom-publickeycredential-parsecreationoptionsfromjson-options-options", "url": "#dom-publickeycredential-parsecreationoptionsfromjson-options-options", "dfnText": "options", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialcreationoptionsjson'] = {"dfnID": "dictdef-publickeycredentialcreationoptionsjson", "url": "#dictdef-publickeycredentialcreationoptionsjson", "dfnText": "PublicKeyCredentialCreationOptionsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptionsjson"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptionsjson\u2460"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialuserentityjson'] = {"dfnID": "dictdef-publickeycredentialuserentityjson", "url": "#dictdef-publickeycredentialuserentityjson", "dfnText": "PublicKeyCredentialUserEntityJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentityjson"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialdescriptorjson'] = {"dfnID": "dictdef-publickeycredentialdescriptorjson", "url": "#dictdef-publickeycredentialdescriptorjson", "dfnText": "PublicKeyCredentialDescriptorJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptorjson"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptorjson\u2460"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
-window.dfnpanelData['dictdef-authenticationextensionsclientinputsjson'] = {"dfnID": "dictdef-authenticationextensionsclientinputsjson", "url": "#dictdef-authenticationextensionsclientinputsjson", "dfnText": "AuthenticationExtensionsClientInputsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionsclientinputsjson"}, {"id": "ref-for-dictdef-authenticationextensionsclientinputsjson\u2460"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-authenticationextensionsclientinputsjson\u2461"}, {"id": "ref-for-dictdef-authenticationextensionsclientinputsjson\u2462"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
-window.dfnpanelData['dom-publickeycredential-parserequestoptionsfromjson-options-options'] = {"dfnID": "dom-publickeycredential-parserequestoptionsfromjson-options-options", "url": "#dom-publickeycredential-parserequestoptionsfromjson-options-options", "dfnText": "options", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialrequestoptionsjson'] = {"dfnID": "dictdef-publickeycredentialrequestoptionsjson", "url": "#dictdef-publickeycredentialrequestoptionsjson", "dfnText": "PublicKeyCredentialRequestOptionsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptionsjson"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptionsjson\u2460"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
+window.dfnpanelData['dom-publickeycredential-parsecreationoptionsfromjson-options-options'] = {"dfnID": "dom-publickeycredential-parsecreationoptionsfromjson-options-options", "url": "#dom-publickeycredential-parsecreationoptionsfromjson-options-options", "dfnText": "options", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialcreationoptionsjson'] = {"dfnID": "dictdef-publickeycredentialcreationoptionsjson", "url": "#dictdef-publickeycredentialcreationoptionsjson", "dfnText": "PublicKeyCredentialCreationOptionsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptionsjson"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptionsjson\u2460"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialuserentityjson'] = {"dfnID": "dictdef-publickeycredentialuserentityjson", "url": "#dictdef-publickeycredentialuserentityjson", "dfnText": "PublicKeyCredentialUserEntityJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentityjson"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialdescriptorjson'] = {"dfnID": "dictdef-publickeycredentialdescriptorjson", "url": "#dictdef-publickeycredentialdescriptorjson", "dfnText": "PublicKeyCredentialDescriptorJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptorjson"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialdescriptorjson\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
+window.dfnpanelData['dictdef-authenticationextensionsclientinputsjson'] = {"dfnID": "dictdef-authenticationextensionsclientinputsjson", "url": "#dictdef-authenticationextensionsclientinputsjson", "dfnText": "AuthenticationExtensionsClientInputsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticationextensionsclientinputsjson"}, {"id": "ref-for-dictdef-authenticationextensionsclientinputsjson\u2460"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-authenticationextensionsclientinputsjson\u2461"}, {"id": "ref-for-dictdef-authenticationextensionsclientinputsjson\u2462"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
+window.dfnpanelData['dom-publickeycredential-parserequestoptionsfromjson-options-options'] = {"dfnID": "dom-publickeycredential-parserequestoptionsfromjson-options-options", "url": "#dom-publickeycredential-parserequestoptionsfromjson-options-options", "dfnText": "options", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialrequestoptionsjson'] = {"dfnID": "dictdef-publickeycredentialrequestoptionsjson", "url": "#dictdef-publickeycredentialrequestoptionsjson", "dfnText": "PublicKeyCredentialRequestOptionsJSON", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptionsjson"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptionsjson\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}], "external": false};
 window.dfnpanelData['authenticatorresponse'] = {"dfnID": "authenticatorresponse", "url": "#authenticatorresponse", "dfnText": "AuthenticatorResponse", "refSections": [{"refs": [{"id": "ref-for-authenticatorresponse"}, {"id": "ref-for-authenticatorresponse\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authenticatorresponse\u2461"}, {"id": "ref-for-authenticatorresponse\u2462"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-authenticatorresponse\u2463"}, {"id": "ref-for-authenticatorresponse\u2464"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-authenticatorresponse\u2465"}, {"id": "ref-for-authenticatorresponse\u2466"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}], "external": false};
 window.dfnpanelData['dom-authenticatorresponse-clientdatajson'] = {"dfnID": "dom-authenticatorresponse-clientdatajson", "url": "#dom-authenticatorresponse-clientdatajson", "dfnText": "clientDataJSON", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2462"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2463"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2464"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2465"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2466"}, {"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2467"}, {"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2460\u24ea"}, {"id": "ref-for-dom-authenticatorresponse-clientdatajson\u2460\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['authenticatorattestationresponse'] = {"dfnID": "authenticatorattestationresponse", "url": "#authenticatorattestationresponse", "dfnText": "AuthenticatorAttestationResponse", "refSections": [{"refs": [{"id": "ref-for-authenticatorattestationresponse"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2461"}, {"id": "ref-for-authenticatorattestationresponse\u2462"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2463"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2464"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2465"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2466"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-authenticatorattestationresponse\u2467"}, {"id": "ref-for-authenticatorattestationresponse\u2468"}], "title": "7.1. Registering a New Credential"}], "external": false};
@@ -11116,10 +11142,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-authenticatorassertionresponse-signature'] = {"dfnID": "dom-authenticatorassertionresponse-signature", "url": "#dom-authenticatorassertionresponse-signature", "dfnText": "signature", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-signature"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-signature\u2460"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-signature\u2461"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['dom-authenticatorassertionresponse-userhandle'] = {"dfnID": "dom-authenticatorassertionresponse-userhandle", "url": "#dom-authenticatorassertionresponse-userhandle", "dfnText": "userHandle", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle"}], "title": "2.2.1. Backwards Compatibility with FIDO U2F"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2462"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2463"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2465"}, {"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2466"}, {"id": "ref-for-dom-authenticatorassertionresponse-userhandle\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
 window.dfnpanelData['dom-authenticatorassertionresponse-attestationobject'] = {"dfnID": "dom-authenticatorassertionresponse-attestationobject", "url": "#dom-authenticatorassertionresponse-attestationobject", "dfnText": "attestationObject", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-attestationobject"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-attestationobject\u2460"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-attestationobject\u2461"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-dom-authenticatorassertionresponse-attestationobject\u2462"}, {"id": "ref-for-dom-authenticatorassertionresponse-attestationobject\u2463"}, {"id": "ref-for-dom-authenticatorassertionresponse-attestationobject\u2464"}, {"id": "ref-for-dom-authenticatorassertionresponse-attestationobject\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialparameters'] = {"dfnID": "dictdef-publickeycredentialparameters", "url": "#dictdef-publickeycredentialparameters", "dfnText": "PublicKeyCredentialParameters", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialparameters"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialparameters\u2460"}, {"id": "ref-for-dictdef-publickeycredentialparameters\u2461"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialparameters\u2462"}, {"id": "ref-for-dictdef-publickeycredentialparameters\u2463"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialparameters'] = {"dfnID": "dictdef-publickeycredentialparameters", "url": "#dictdef-publickeycredentialparameters", "dfnText": "PublicKeyCredentialParameters", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialparameters"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialparameters\u2460"}, {"id": "ref-for-dictdef-publickeycredentialparameters\u2461"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialparameters\u2462"}, {"id": "ref-for-dictdef-publickeycredentialparameters\u2463"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialparameters-type'] = {"dfnID": "dom-publickeycredentialparameters-type", "url": "#dom-publickeycredentialparameters-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialparameters-type"}, {"id": "ref-for-dom-publickeycredentialparameters-type\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialparameters-type\u2461"}, {"id": "ref-for-dom-publickeycredentialparameters-type\u2462"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialparameters-alg'] = {"dfnID": "dom-publickeycredentialparameters-alg", "url": "#dom-publickeycredentialparameters-alg", "dfnText": "alg", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialparameters-alg"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialparameters-alg\u2460"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialparameters-alg\u2461"}], "title": "7.1. Registering a New Credential"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialcreationoptions'] = {"dfnID": "dictdef-publickeycredentialcreationoptions", "url": "#dictdef-publickeycredentialcreationoptions", "dfnText": "PublicKeyCredentialCreationOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions"}], "title": "5.1.1. CredentialCreationOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2461"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2462"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2463"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2464"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2466"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2467"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2460\u24ea"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialcreationoptions'] = {"dfnID": "dictdef-publickeycredentialcreationoptions", "url": "#dictdef-publickeycredentialcreationoptions", "dfnText": "PublicKeyCredentialCreationOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions"}], "title": "5.1.1. CredentialCreationOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2461"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2462"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2463"}, {"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2465"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2466"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2467"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialcreationoptions\u2460\u24ea"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-rp'] = {"dfnID": "dom-publickeycredentialcreationoptions-rp", "url": "#dom-publickeycredentialcreationoptions-rp", "dfnText": "rp", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-rp"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2461"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2462"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2463"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2464"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2465"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2466"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2467"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-rp\u2468"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-user'] = {"dfnID": "dom-publickeycredentialcreationoptions-user", "url": "#dom-publickeycredentialcreationoptions-user", "dfnText": "user", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2462"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2463"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-user\u2466"}], "title": "13.4.6. Credential Loss and Key Mobility"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialcreationoptions-challenge'] = {"dfnID": "dom-publickeycredentialcreationoptions-challenge", "url": "#dom-publickeycredentialcreationoptions-challenge", "dfnText": "challenge", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-challenge\u2463"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
@@ -11132,12 +11158,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-publickeycredentialcreationoptions-extensions'] = {"dfnID": "dom-publickeycredentialcreationoptions-extensions", "url": "#dom-publickeycredentialcreationoptions-extensions", "dfnText": "extensions", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-extensions"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2460"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2463"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2464"}, {"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-dom-publickeycredentialcreationoptions-extensions\u2466"}], "title": "9.3. Extending Request Parameters"}], "external": false};
 window.dfnpanelData['dictdef-publickeycredentialentity'] = {"dfnID": "dictdef-publickeycredentialentity", "url": "#dictdef-publickeycredentialentity", "dfnText": "PublicKeyCredentialEntity", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialentity"}, {"id": "ref-for-dictdef-publickeycredentialentity\u2460"}, {"id": "ref-for-dictdef-publickeycredentialentity\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialentity\u2462"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialentity\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialentity-name'] = {"dfnID": "dom-publickeycredentialentity-name", "url": "#dom-publickeycredentialentity-name", "dfnText": "name", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialentity-name"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialentity-name\u2460"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2461"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialentity-name\u2463"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2464"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2465"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2466"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2467"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2468"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2460\u24ea"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialentity-name\u2460\u2460"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialentity-name\u2460\u2461"}, {"id": "ref-for-dom-publickeycredentialentity-name\u2460\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialentity-name\u2460\u2463"}], "title": "6.4. String Handling"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialrpentity'] = {"dfnID": "dictdef-publickeycredentialrpentity", "url": "#dictdef-publickeycredentialrpentity", "dfnText": "PublicKeyCredentialRpEntity", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2460"}, {"id": "ref-for-dictdef-publickeycredentialrpentity\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2463"}, {"id": "ref-for-dictdef-publickeycredentialrpentity\u2464"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialrpentity'] = {"dfnID": "dictdef-publickeycredentialrpentity", "url": "#dictdef-publickeycredentialrpentity", "dfnText": "PublicKeyCredentialRpEntity", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2460"}, {"id": "ref-for-dictdef-publickeycredentialrpentity\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2463"}, {"id": "ref-for-dictdef-publickeycredentialrpentity\u2464"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrpentity\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrpentity-id'] = {"dfnID": "dom-publickeycredentialrpentity-id", "url": "#dom-publickeycredentialrpentity-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2460"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2461"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2462"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2463"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2464"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2465"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2466"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2468"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u2460"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u2461"}, {"id": "ref-for-dom-publickeycredentialrpentity-id\u2460\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}], "external": false};
 window.dfnpanelData['dictdef-publickeycredentialuserentity'] = {"dfnID": "dictdef-publickeycredentialuserentity", "url": "#dictdef-publickeycredentialuserentity", "dfnText": "PublicKeyCredentialUserEntity", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity"}, {"id": "ref-for-dictdef-publickeycredentialuserentity\u2460"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2461"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2462"}, {"id": "ref-for-dictdef-publickeycredentialuserentity\u2463"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2464"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2465"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialuserentity\u2466"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialuserentity-id'] = {"dfnID": "dom-publickeycredentialuserentity-id", "url": "#dom-publickeycredentialuserentity-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2461"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2462"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2463"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2464"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2465"}, {"id": "ref-for-dom-publickeycredentialuserentity-id\u2466"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2467"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2468"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-id\u2460\u24ea"}], "title": "14.4.2. Privacy of personally identifying information Stored in Authenticators"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialuserentity-displayname'] = {"dfnID": "dom-publickeycredentialuserentity-displayname", "url": "#dom-publickeycredentialuserentity-displayname", "dfnText": "displayName", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2461"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2462"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2463"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2464"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2465"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2466"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2467"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2468"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2460"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialuserentity-displayname\u2460\u2462"}], "title": "6.4. String Handling"}], "external": false};
-window.dfnpanelData['dictdef-authenticatorselectioncriteria'] = {"dfnID": "dictdef-authenticatorselectioncriteria", "url": "#dictdef-authenticatorselectioncriteria", "dfnText": "AuthenticatorSelectionCriteria", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria\u2460"}, {"id": "ref-for-dictdef-authenticatorselectioncriteria\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria\u2462"}, {"id": "ref-for-dictdef-authenticatorselectioncriteria\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}], "external": false};
+window.dfnpanelData['dictdef-authenticatorselectioncriteria'] = {"dfnID": "dictdef-authenticatorselectioncriteria", "url": "#dictdef-authenticatorselectioncriteria", "dfnText": "AuthenticatorSelectionCriteria", "refSections": [{"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria\u2460"}, {"id": "ref-for-dictdef-authenticatorselectioncriteria\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-dictdef-authenticatorselectioncriteria\u2462"}, {"id": "ref-for-dictdef-authenticatorselectioncriteria\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}], "external": false};
 window.dfnpanelData['dom-authenticatorselectioncriteria-authenticatorattachment'] = {"dfnID": "dom-authenticatorselectioncriteria-authenticatorattachment", "url": "#dom-authenticatorselectioncriteria-authenticatorattachment", "dfnText": "authenticatorAttachment", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-authenticatorattachment\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}], "external": false};
 window.dfnpanelData['dom-authenticatorselectioncriteria-residentkey'] = {"dfnID": "dom-authenticatorselectioncriteria-residentkey", "url": "#dom-authenticatorselectioncriteria-residentkey", "dfnText": "residentKey", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey"}, {"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2461"}, {"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2462"}, {"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2463"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2464"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2465"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-residentkey\u2466"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};
 window.dfnpanelData['dom-authenticatorselectioncriteria-requireresidentkey'] = {"dfnID": "dom-authenticatorselectioncriteria-requireresidentkey", "url": "#dom-authenticatorselectioncriteria-requireresidentkey", "dfnText": "requireResidentKey", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-requireresidentkey"}, {"id": "ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2461"}, {"id": "ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-dom-authenticatorselectioncriteria-requireresidentkey\u2463"}], "title": "6.2.2. Credential Storage Modality"}], "external": false};
@@ -11155,7 +11181,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-attestationconveyancepreference-indirect'] = {"dfnID": "dom-attestationconveyancepreference-indirect", "url": "#dom-attestationconveyancepreference-indirect", "dfnText": "indirect", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-indirect\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}], "external": false};
 window.dfnpanelData['dom-attestationconveyancepreference-direct'] = {"dfnID": "dom-attestationconveyancepreference-direct", "url": "#dom-attestationconveyancepreference-direct", "dfnText": "direct", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-direct"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-direct\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}], "external": false};
 window.dfnpanelData['dom-attestationconveyancepreference-enterprise'] = {"dfnID": "dom-attestationconveyancepreference-enterprise", "url": "#dom-attestationconveyancepreference-enterprise", "dfnText": "enterprise", "refSections": [{"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise"}, {"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2462"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-attestationconveyancepreference-enterprise\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}], "external": false};
-window.dfnpanelData['dictdef-publickeycredentialrequestoptions'] = {"dfnID": "dictdef-publickeycredentialrequestoptions", "url": "#dictdef-publickeycredentialrequestoptions", "dfnText": "PublicKeyCredentialRequestOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2461"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2463"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2464"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2465"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2466"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2467"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u24ea"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2461"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2463"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
+window.dfnpanelData['dictdef-publickeycredentialrequestoptions'] = {"dfnID": "dictdef-publickeycredentialrequestoptions", "url": "#dictdef-publickeycredentialrequestoptions", "dfnText": "PublicKeyCredentialRequestOptions", "refSections": [{"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions"}], "title": "5.1.2. CredentialRequestOptions Dictionary Extension"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2461"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2463"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2464"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2465"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2466"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2467"}, {"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u24ea"}], "title": "5.8.1.2. Limited Verification Algorithm"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2460"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2461"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2463"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-dictdef-publickeycredentialrequestoptions\u2460\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-challenge'] = {"dfnID": "dom-publickeycredentialrequestoptions-challenge", "url": "#dom-publickeycredentialrequestoptions-challenge", "dfnText": "challenge", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2461"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-challenge\u2463"}], "title": "13.4.3. Cryptographic Challenges"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-timeout'] = {"dfnID": "dom-publickeycredentialrequestoptions-timeout", "url": "#dom-publickeycredentialrequestoptions-timeout", "dfnText": "timeout", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-timeout\u2463"}], "title": "15. Accessibility Considerations"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialrequestoptions-rpid'] = {"dfnID": "dom-publickeycredentialrequestoptions-rpid", "url": "#dom-publickeycredentialrequestoptions-rpid", "dfnText": "rpId", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-rpid"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2460"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2461"}, {"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2463"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialrequestoptions-rpid\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}], "external": false};
@@ -11187,13 +11213,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['dom-publickeycredentialdescriptor-type'] = {"dfnID": "dom-publickeycredentialdescriptor-type", "url": "#dom-publickeycredentialdescriptor-type", "dfnText": "type", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-type\u2462"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2463"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-type\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialdescriptor-id'] = {"dfnID": "dom-publickeycredentialdescriptor-id", "url": "#dom-publickeycredentialdescriptor-id", "dfnText": "id", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2462"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2465"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2466"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2467"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u24ea"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2460"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2461"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2462"}, {"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2463"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-id\u2460\u2464"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": false};
 window.dfnpanelData['dom-publickeycredentialdescriptor-transports'] = {"dfnID": "dom-publickeycredentialdescriptor-transports", "url": "#dom-publickeycredentialdescriptor-transports", "dfnText": "transports", "refSections": [{"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2461"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2462"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2463"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2464"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2466"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2467"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2468"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460\u24ea"}, {"id": "ref-for-dom-publickeycredentialdescriptor-transports\u2460\u2460"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}], "external": false};
-window.dfnpanelData['enumdef-authenticatortransport'] = {"dfnID": "enumdef-authenticatortransport", "url": "#enumdef-authenticatortransport", "dfnText": "AuthenticatorTransport", "refSections": [{"refs": [{"id": "ref-for-enumdef-authenticatortransport"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2460"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2462"}, {"id": "ref-for-enumdef-authenticatortransport\u2463"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2464"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2465"}], "title": "11.3. Add Virtual Authenticator"}], "external": false};
+window.dfnpanelData['enumdef-authenticatortransport'] = {"dfnID": "enumdef-authenticatortransport", "url": "#enumdef-authenticatortransport", "dfnText": "AuthenticatorTransport", "refSections": [{"refs": [{"id": "ref-for-enumdef-authenticatortransport"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2460"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2461"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2462"}, {"id": "ref-for-enumdef-authenticatortransport\u2463"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2464"}, {"id": "ref-for-enumdef-authenticatortransport\u2465"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2466"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-enumdef-authenticatortransport\u2467"}], "title": "11.3. Add Virtual Authenticator"}], "external": false};
 window.dfnpanelData['dom-authenticatortransport-usb'] = {"dfnID": "dom-authenticatortransport-usb", "url": "#dom-authenticatortransport-usb", "dfnText": "usb", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-usb"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}], "external": false};
 window.dfnpanelData['dom-authenticatortransport-nfc'] = {"dfnID": "dom-authenticatortransport-nfc", "url": "#dom-authenticatortransport-nfc", "dfnText": "nfc", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-nfc"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}], "external": false};
 window.dfnpanelData['dom-authenticatortransport-ble'] = {"dfnID": "dom-authenticatortransport-ble", "url": "#dom-authenticatortransport-ble", "dfnText": "ble", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-ble"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}], "external": false};
 window.dfnpanelData['dom-authenticatortransport-smart-card'] = {"dfnID": "dom-authenticatortransport-smart-card", "url": "#dom-authenticatortransport-smart-card", "dfnText": "smart-card", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-smart-card"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}], "external": false};
-window.dfnpanelData['dom-authenticatortransport-hybrid'] = {"dfnID": "dom-authenticatortransport-hybrid", "url": "#dom-authenticatortransport-hybrid", "dfnText": "hybrid", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-hybrid"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}], "external": false};
-window.dfnpanelData['dom-authenticatortransport-internal'] = {"dfnID": "dom-authenticatortransport-internal", "url": "#dom-authenticatortransport-internal", "dfnText": "internal", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-internal"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-internal\u2460"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-internal\u2461"}], "title": "11.2. Virtual Authenticators"}], "external": false};
+window.dfnpanelData['dom-authenticatortransport-hybrid'] = {"dfnID": "dom-authenticatortransport-hybrid", "url": "#dom-authenticatortransport-hybrid", "dfnText": "hybrid", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-hybrid"}, {"id": "ref-for-dom-authenticatortransport-hybrid\u2460"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-hybrid\u2461"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-hybrid\u2462"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
+window.dfnpanelData['dom-authenticatortransport-internal'] = {"dfnID": "dom-authenticatortransport-internal", "url": "#dom-authenticatortransport-internal", "dfnText": "internal", "refSections": [{"refs": [{"id": "ref-for-dom-authenticatortransport-internal"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-internal\u2460"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-internal\u2461"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-dom-authenticatortransport-internal\u2462"}], "title": "11.2. Virtual Authenticators"}], "external": false};
 window.dfnpanelData['typedefdef-cosealgorithmidentifier'] = {"dfnID": "typedefdef-cosealgorithmidentifier", "url": "#typedefdef-cosealgorithmidentifier", "dfnText": "COSEAlgorithmIdentifier", "refSections": [{"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier"}, {"id": "ref-for-typedefdef-cosealgorithmidentifier\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2461"}, {"id": "ref-for-typedefdef-cosealgorithmidentifier\u2462"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2463"}, {"id": "ref-for-typedefdef-cosealgorithmidentifier\u2464"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2465"}, {"id": "ref-for-typedefdef-cosealgorithmidentifier\u2466"}], "title": "5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2467"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2468"}, {"id": "ref-for-typedefdef-cosealgorithmidentifier\u2460\u24ea"}], "title": "5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2460\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2460\u2461"}], "title": "6.5.2. Attested Credential Data"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2460\u2462"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-typedefdef-cosealgorithmidentifier\u2460\u2463"}], "title": "8.3. TPM Attestation Statement Format"}], "external": false};
 window.dfnpanelData['enumdef-userverificationrequirement'] = {"dfnID": "enumdef-userverificationrequirement", "url": "#enumdef-userverificationrequirement", "dfnText": "UserVerificationRequirement", "refSections": [{"refs": [{"id": "ref-for-enumdef-userverificationrequirement"}, {"id": "ref-for-enumdef-userverificationrequirement\u2460"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-enumdef-userverificationrequirement\u2461"}, {"id": "ref-for-enumdef-userverificationrequirement\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-enumdef-userverificationrequirement\u2463"}, {"id": "ref-for-enumdef-userverificationrequirement\u2464"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-enumdef-userverificationrequirement\u2465"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": false};
 window.dfnpanelData['dom-userverificationrequirement-required'] = {"dfnID": "dom-userverificationrequirement-required", "url": "#dom-userverificationrequirement-required", "dfnText": "required", "refSections": [{"refs": [{"id": "ref-for-dom-userverificationrequirement-required"}, {"id": "ref-for-dom-userverificationrequirement-required\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-dom-userverificationrequirement-required\u2461"}, {"id": "ref-for-dom-userverificationrequirement-required\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-dom-userverificationrequirement-required\u2463"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-dom-userverificationrequirement-required\u2464"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-dom-userverificationrequirement-required\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": false};
@@ -11221,22 +11247,23 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['signature-counter'] = {"dfnID": "signature-counter", "url": "#signature-counter", "dfnText": "Signature Counter", "refSections": [{"refs": [{"id": "ref-for-signature-counter"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-signature-counter\u2460"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-signature-counter\u2461"}, {"id": "ref-for-signature-counter\u2462"}, {"id": "ref-for-signature-counter\u2463"}, {"id": "ref-for-signature-counter\u2464"}, {"id": "ref-for-signature-counter\u2465"}, {"id": "ref-for-signature-counter\u2466"}, {"id": "ref-for-signature-counter\u2467"}, {"id": "ref-for-signature-counter\u2468"}, {"id": "ref-for-signature-counter\u2460\u24ea"}, {"id": "ref-for-signature-counter\u2460\u2460"}, {"id": "ref-for-signature-counter\u2460\u2461"}, {"id": "ref-for-signature-counter\u2460\u2462"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-signature-counter\u2460\u2463"}, {"id": "ref-for-signature-counter\u2460\u2464"}, {"id": "ref-for-signature-counter\u2460\u2465"}, {"id": "ref-for-signature-counter\u2460\u2466"}, {"id": "ref-for-signature-counter\u2460\u2467"}, {"id": "ref-for-signature-counter\u2460\u2468"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-signature-counter\u2461\u24ea"}, {"id": "ref-for-signature-counter\u2461\u2460"}, {"id": "ref-for-signature-counter\u2461\u2461"}, {"id": "ref-for-signature-counter\u2461\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-signature-counter\u2461\u2463"}, {"id": "ref-for-signature-counter\u2461\u2464"}], "title": "11.5. Add Credential"}], "external": false};
 window.dfnpanelData['authenticator-type'] = {"dfnID": "authenticator-type", "url": "#authenticator-type", "dfnText": "authenticator type", "refSections": [{"refs": [{"id": "ref-for-authenticator-type"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-authenticator-type\u2460"}, {"id": "ref-for-authenticator-type\u2461"}, {"id": "ref-for-authenticator-type\u2462"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
 window.dfnpanelData['second-factor-platform-authenticator'] = {"dfnID": "second-factor-platform-authenticator", "url": "#second-factor-platform-authenticator", "dfnText": "Second-factor platform authenticator", "refSections": [{"refs": [{"id": "ref-for-second-factor-platform-authenticator"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
-window.dfnpanelData['user-verifying-platform-authenticator'] = {"dfnID": "user-verifying-platform-authenticator", "url": "#user-verifying-platform-authenticator", "dfnText": "User-verifying platform authenticator", "refSections": [{"refs": [{"id": "ref-for-user-verifying-platform-authenticator"}, {"id": "ref-for-user-verifying-platform-authenticator\u2460"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-user-verifying-platform-authenticator\u2461"}, {"id": "ref-for-user-verifying-platform-authenticator\u2462"}, {"id": "ref-for-user-verifying-platform-authenticator\u2463"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-user-verifying-platform-authenticator\u2464"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
+window.dfnpanelData['user-verifying-platform-authenticator'] = {"dfnID": "user-verifying-platform-authenticator", "url": "#user-verifying-platform-authenticator", "dfnText": "User-verifying platform authenticator", "refSections": [{"refs": [{"id": "ref-for-user-verifying-platform-authenticator"}, {"id": "ref-for-user-verifying-platform-authenticator\u2460"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-user-verifying-platform-authenticator\u2461"}, {"id": "ref-for-user-verifying-platform-authenticator\u2462"}, {"id": "ref-for-user-verifying-platform-authenticator\u2463"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-user-verifying-platform-authenticator\u2464"}, {"id": "ref-for-user-verifying-platform-authenticator\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-user-verifying-platform-authenticator\u2466"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
 window.dfnpanelData['second-factor-roaming-authenticator'] = {"dfnID": "second-factor-roaming-authenticator", "url": "#second-factor-roaming-authenticator", "dfnText": "Second-factor roaming authenticator", "refSections": [{"refs": [{"id": "ref-for-second-factor-roaming-authenticator"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
 window.dfnpanelData['first-factor-roaming-authenticator'] = {"dfnID": "first-factor-roaming-authenticator", "url": "#first-factor-roaming-authenticator", "dfnText": "First-factor roaming authenticator", "refSections": [{"refs": [{"id": "ref-for-first-factor-roaming-authenticator"}], "title": "1.3. Sample API Usage Scenarios"}, {"refs": [{"id": "ref-for-first-factor-roaming-authenticator\u2460"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
+window.dfnpanelData['passkey-platform-authenticator'] = {"dfnID": "passkey-platform-authenticator", "url": "#passkey-platform-authenticator", "dfnText": "Passkey platform authenticator", "refSections": [{"refs": [{"id": "ref-for-passkey-platform-authenticator"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}], "external": false};
 window.dfnpanelData['authenticator-attachment-modality'] = {"dfnID": "authenticator-attachment-modality", "url": "#authenticator-attachment-modality", "dfnText": "Authenticator Attachment Modality", "refSections": [{"refs": [{"id": "ref-for-authenticator-attachment-modality"}, {"id": "ref-for-authenticator-attachment-modality\u2460"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-authenticator-attachment-modality\u2461"}, {"id": "ref-for-authenticator-attachment-modality\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-attachment-modality\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-attachment-modality\u2464"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-authenticator-attachment-modality\u2465"}, {"id": "ref-for-authenticator-attachment-modality\u2466"}, {"id": "ref-for-authenticator-attachment-modality\u2467"}, {"id": "ref-for-authenticator-attachment-modality\u2468"}, {"id": "ref-for-authenticator-attachment-modality\u2460\u24ea"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-authenticator-attachment-modality\u2460\u2460"}, {"id": "ref-for-authenticator-attachment-modality\u2460\u2461"}, {"id": "ref-for-authenticator-attachment-modality\u2460\u2462"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
-window.dfnpanelData['platform-authenticators'] = {"dfnID": "platform-authenticators", "url": "#platform-authenticators", "dfnText": "platform authenticators", "refSections": [{"refs": [{"id": "ref-for-platform-authenticators"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460"}, {"id": "ref-for-platform-authenticators\u2461"}, {"id": "ref-for-platform-authenticators\u2462"}, {"id": "ref-for-platform-authenticators\u2463"}, {"id": "ref-for-platform-authenticators\u2464"}, {"id": "ref-for-platform-authenticators\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-platform-authenticators\u2466"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-platform-authenticators\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-platform-authenticators\u2468"}, {"id": "ref-for-platform-authenticators\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2462"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2463"}, {"id": "ref-for-platform-authenticators\u2460\u2464"}, {"id": "ref-for-platform-authenticators\u2460\u2465"}, {"id": "ref-for-platform-authenticators\u2460\u2466"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2467"}, {"id": "ref-for-platform-authenticators\u2460\u2468"}, {"id": "ref-for-platform-authenticators\u2461\u24ea"}, {"id": "ref-for-platform-authenticators\u2461\u2460"}, {"id": "ref-for-platform-authenticators\u2461\u2461"}, {"id": "ref-for-platform-authenticators\u2461\u2462"}, {"id": "ref-for-platform-authenticators\u2461\u2463"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2464"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2465"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2466"}, {"id": "ref-for-platform-authenticators\u2461\u2467"}], "title": "12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2468"}], "title": "12.2. WebAuthn Attestation Statement Format Identifier Registrations"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u24ea"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u2460"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u2461"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u2462"}, {"id": "ref-for-platform-authenticators\u2462\u2463"}], "title": "14.5.3. Privacy Between Operating System Accounts"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u2464"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['roaming-authenticators'] = {"dfnID": "roaming-authenticators", "url": "#roaming-authenticators", "dfnText": "roaming authenticators", "refSections": [{"refs": [{"id": "ref-for-roaming-authenticators"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2460"}, {"id": "ref-for-roaming-authenticators\u2461"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2462"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2463"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2465"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2466"}, {"id": "ref-for-roaming-authenticators\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2468"}, {"id": "ref-for-roaming-authenticators\u2460\u24ea"}, {"id": "ref-for-roaming-authenticators\u2460\u2460"}, {"id": "ref-for-roaming-authenticators\u2460\u2461"}, {"id": "ref-for-roaming-authenticators\u2460\u2462"}, {"id": "ref-for-roaming-authenticators\u2460\u2463"}, {"id": "ref-for-roaming-authenticators\u2460\u2464"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2460\u2465"}, {"id": "ref-for-roaming-authenticators\u2460\u2466"}, {"id": "ref-for-roaming-authenticators\u2460\u2467"}, {"id": "ref-for-roaming-authenticators\u2460\u2468"}, {"id": "ref-for-roaming-authenticators\u2461\u24ea"}, {"id": "ref-for-roaming-authenticators\u2461\u2460"}, {"id": "ref-for-roaming-authenticators\u2461\u2461"}, {"id": "ref-for-roaming-authenticators\u2461\u2462"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2461\u2463"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2461\u2464"}, {"id": "ref-for-roaming-authenticators\u2461\u2465"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2461\u2466"}, {"id": "ref-for-roaming-authenticators\u2461\u2467"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['platform-attachment'] = {"dfnID": "platform-attachment", "url": "#platform-attachment", "dfnText": "platform attachment", "refSections": [{"refs": [{"id": "ref-for-platform-attachment"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-platform-attachment\u2460"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-platform-attachment\u2461"}, {"id": "ref-for-platform-attachment\u2462"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-platform-attachment\u2463"}], "title": "11.2. Virtual Authenticators"}], "external": false};
+window.dfnpanelData['platform-authenticators'] = {"dfnID": "platform-authenticators", "url": "#platform-authenticators", "dfnText": "platform authenticators", "refSections": [{"refs": [{"id": "ref-for-platform-authenticators"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460"}, {"id": "ref-for-platform-authenticators\u2461"}, {"id": "ref-for-platform-authenticators\u2462"}, {"id": "ref-for-platform-authenticators\u2463"}, {"id": "ref-for-platform-authenticators\u2464"}, {"id": "ref-for-platform-authenticators\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-platform-authenticators\u2466"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-platform-authenticators\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-platform-authenticators\u2468"}, {"id": "ref-for-platform-authenticators\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2462"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2463"}, {"id": "ref-for-platform-authenticators\u2460\u2464"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-platform-authenticators\u2460\u2465"}, {"id": "ref-for-platform-authenticators\u2460\u2466"}, {"id": "ref-for-platform-authenticators\u2460\u2467"}, {"id": "ref-for-platform-authenticators\u2460\u2468"}, {"id": "ref-for-platform-authenticators\u2461\u24ea"}, {"id": "ref-for-platform-authenticators\u2461\u2460"}, {"id": "ref-for-platform-authenticators\u2461\u2461"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2462"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2463"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2464"}, {"id": "ref-for-platform-authenticators\u2461\u2465"}], "title": "12.1. WebAuthn Attestation Statement Format Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2466"}], "title": "12.2. WebAuthn Attestation Statement Format Identifier Registrations"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2467"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-platform-authenticators\u2461\u2468"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u24ea"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u2460"}, {"id": "ref-for-platform-authenticators\u2462\u2461"}], "title": "14.5.3. Privacy Between Operating System Accounts"}, {"refs": [{"id": "ref-for-platform-authenticators\u2462\u2462"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['roaming-authenticators'] = {"dfnID": "roaming-authenticators", "url": "#roaming-authenticators", "dfnText": "roaming authenticators", "refSections": [{"refs": [{"id": "ref-for-roaming-authenticators"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2460"}, {"id": "ref-for-roaming-authenticators\u2461"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2462"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2463"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2464"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2465"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2466"}, {"id": "ref-for-roaming-authenticators\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2468"}, {"id": "ref-for-roaming-authenticators\u2460\u24ea"}, {"id": "ref-for-roaming-authenticators\u2460\u2460"}, {"id": "ref-for-roaming-authenticators\u2460\u2461"}, {"id": "ref-for-roaming-authenticators\u2460\u2462"}, {"id": "ref-for-roaming-authenticators\u2460\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2460\u2464"}, {"id": "ref-for-roaming-authenticators\u2460\u2465"}, {"id": "ref-for-roaming-authenticators\u2460\u2466"}, {"id": "ref-for-roaming-authenticators\u2460\u2467"}, {"id": "ref-for-roaming-authenticators\u2460\u2468"}, {"id": "ref-for-roaming-authenticators\u2461\u24ea"}, {"id": "ref-for-roaming-authenticators\u2461\u2460"}, {"id": "ref-for-roaming-authenticators\u2461\u2461"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2461\u2462"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2461\u2463"}, {"id": "ref-for-roaming-authenticators\u2461\u2464"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-roaming-authenticators\u2461\u2465"}, {"id": "ref-for-roaming-authenticators\u2461\u2466"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['platform-attachment'] = {"dfnID": "platform-attachment", "url": "#platform-attachment", "dfnText": "platform attachment", "refSections": [{"refs": [{"id": "ref-for-platform-attachment"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-platform-attachment\u2460"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-platform-attachment\u2461"}, {"id": "ref-for-platform-attachment\u2462"}, {"id": "ref-for-platform-attachment\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-platform-attachment\u2464"}], "title": "11.2. Virtual Authenticators"}], "external": false};
 window.dfnpanelData['platform-credential'] = {"dfnID": "platform-credential", "url": "#platform-credential", "dfnText": "platform credential", "refSections": [{"refs": [{"id": "ref-for-platform-credential"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-platform-credential\u2460"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-platform-credential\u2461"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-platform-credential\u2462"}, {"id": "ref-for-platform-credential\u2463"}], "title": "14.5.3. Privacy Between Operating System Accounts"}], "external": false};
-window.dfnpanelData['cross-platform-attachment'] = {"dfnID": "cross-platform-attachment", "url": "#cross-platform-attachment", "dfnText": "cross-platform attachment", "refSections": [{"refs": [{"id": "ref-for-cross-platform-attachment"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2460"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2461"}, {"id": "ref-for-cross-platform-attachment\u2462"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2463"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2464"}], "title": "11.2. Virtual Authenticators"}], "external": false};
+window.dfnpanelData['cross-platform-attachment'] = {"dfnID": "cross-platform-attachment", "url": "#cross-platform-attachment", "dfnText": "cross-platform attachment", "refSections": [{"refs": [{"id": "ref-for-cross-platform-attachment"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2460"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2461"}, {"id": "ref-for-cross-platform-attachment\u2462"}, {"id": "ref-for-cross-platform-attachment\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2464"}], "title": "6.2.1. Authenticator Attachment Modality"}, {"refs": [{"id": "ref-for-cross-platform-attachment\u2465"}], "title": "11.2. Virtual Authenticators"}], "external": false};
 window.dfnpanelData['roaming-credential'] = {"dfnID": "roaming-credential", "url": "#roaming-credential", "dfnText": "roaming\ncredential", "refSections": [{"refs": [{"id": "ref-for-roaming-credential"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-roaming-credential\u2460"}], "title": "13.4.6. Credential Loss and Key Mobility"}], "external": false};
-window.dfnpanelData['credential-storage-modality'] = {"dfnID": "credential-storage-modality", "url": "#credential-storage-modality", "dfnText": "credential storage\nmodality", "refSections": [{"refs": [{"id": "ref-for-credential-storage-modality"}, {"id": "ref-for-credential-storage-modality\u2460"}, {"id": "ref-for-credential-storage-modality\u2461"}, {"id": "ref-for-credential-storage-modality\u2462"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
-window.dfnpanelData['client-side-credential-storage-modality'] = {"dfnID": "client-side-credential-storage-modality", "url": "#client-side-credential-storage-modality", "dfnText": "client-side credential storage modality", "refSections": [{"refs": [{"id": "ref-for-client-side-credential-storage-modality"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-side-credential-storage-modality\u2460"}, {"id": "ref-for-client-side-credential-storage-modality\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-side-credential-storage-modality\u2462"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client-side-credential-storage-modality\u2463"}, {"id": "ref-for-client-side-credential-storage-modality\u2464"}], "title": "6.2.2. Credential Storage Modality"}], "external": false};
+window.dfnpanelData['credential-storage-modality'] = {"dfnID": "credential-storage-modality", "url": "#credential-storage-modality", "dfnText": "credential storage\nmodality", "refSections": [{"refs": [{"id": "ref-for-credential-storage-modality"}, {"id": "ref-for-credential-storage-modality\u2460"}, {"id": "ref-for-credential-storage-modality\u2461"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
+window.dfnpanelData['client-side-credential-storage-modality'] = {"dfnID": "client-side-credential-storage-modality", "url": "#client-side-credential-storage-modality", "dfnText": "client-side credential storage modality", "refSections": [{"refs": [{"id": "ref-for-client-side-credential-storage-modality"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-client-side-credential-storage-modality\u2460"}, {"id": "ref-for-client-side-credential-storage-modality\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-side-credential-storage-modality\u2462"}, {"id": "ref-for-client-side-credential-storage-modality\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-client-side-credential-storage-modality\u2464"}, {"id": "ref-for-client-side-credential-storage-modality\u2465"}], "title": "6.2.2. Credential Storage Modality"}], "external": false};
 window.dfnpanelData['discoverable-credential-capable'] = {"dfnID": "discoverable-credential-capable", "url": "#discoverable-credential-capable", "dfnText": "discoverable\ncredential capable", "refSections": [{"refs": [{"id": "ref-for-discoverable-credential-capable"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-discoverable-credential-capable\u2460"}, {"id": "ref-for-discoverable-credential-capable\u2461"}, {"id": "ref-for-discoverable-credential-capable\u2462"}, {"id": "ref-for-discoverable-credential-capable\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-discoverable-credential-capable\u2464"}], "title": "6.2.2. Credential Storage Modality"}], "external": false};
 window.dfnpanelData['server-side-credential-storage-modality'] = {"dfnID": "server-side-credential-storage-modality", "url": "#server-side-credential-storage-modality", "dfnText": "server-side credential storage modality", "refSections": [{"refs": [{"id": "ref-for-server-side-credential-storage-modality"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-server-side-credential-storage-modality\u2460"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
 window.dfnpanelData['authentication-factor-capability'] = {"dfnID": "authentication-factor-capability", "url": "#authentication-factor-capability", "dfnText": "Authentication Factor Capability", "refSections": [{"refs": [{"id": "ref-for-authentication-factor-capability"}, {"id": "ref-for-authentication-factor-capability\u2460"}, {"id": "ref-for-authentication-factor-capability\u2461"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
-window.dfnpanelData['multi-factor-capable'] = {"dfnID": "multi-factor-capable", "url": "#multi-factor-capable", "dfnText": "multi-factor capable", "refSections": [{"refs": [{"id": "ref-for-multi-factor-capable"}, {"id": "ref-for-multi-factor-capable\u2460"}, {"id": "ref-for-multi-factor-capable\u2461"}, {"id": "ref-for-multi-factor-capable\u2462"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-multi-factor-capable\u2463"}, {"id": "ref-for-multi-factor-capable\u2464"}], "title": "6.2.3. Authentication Factor Capability"}], "external": false};
+window.dfnpanelData['multi-factor-capable'] = {"dfnID": "multi-factor-capable", "url": "#multi-factor-capable", "dfnText": "multi-factor capable", "refSections": [{"refs": [{"id": "ref-for-multi-factor-capable"}, {"id": "ref-for-multi-factor-capable\u2460"}, {"id": "ref-for-multi-factor-capable\u2461"}, {"id": "ref-for-multi-factor-capable\u2462"}, {"id": "ref-for-multi-factor-capable\u2463"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-multi-factor-capable\u2464"}, {"id": "ref-for-multi-factor-capable\u2465"}], "title": "6.2.3. Authentication Factor Capability"}], "external": false};
 window.dfnpanelData['single-factor-capable'] = {"dfnID": "single-factor-capable", "url": "#single-factor-capable", "dfnText": "single-factor capable", "refSections": [{"refs": [{"id": "ref-for-single-factor-capable"}, {"id": "ref-for-single-factor-capable\u2460"}], "title": "6.2. Authenticator Taxonomy"}], "external": false};
 window.dfnpanelData['authenticator-operations'] = {"dfnID": "authenticator-operations", "url": "#authenticator-operations", "dfnText": "Authenticator Operations", "refSections": [{"refs": [{"id": "ref-for-authenticator-operations"}], "title": "4. Terminology"}], "external": false};
 window.dfnpanelData['authenticator-session'] = {"dfnID": "authenticator-session", "url": "#authenticator-session", "dfnText": "authenticator session", "refSections": [{"refs": [{"id": "ref-for-authenticator-session"}, {"id": "ref-for-authenticator-session\u2460"}], "title": "5.6. Abort Operations with AbortSignal"}, {"refs": [{"id": "ref-for-authenticator-session\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator-session\u2462"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator-session\u2463"}, {"id": "ref-for-authenticator-session\u2464"}], "title": "6.3.4. The authenticatorCancel Operation"}], "external": false};
@@ -11282,7 +11309,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['client-extension'] = {"dfnID": "client-extension", "url": "#client-extension", "dfnText": "client extension", "refSections": [{"refs": [{"id": "ref-for-client-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-extension\u2462"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-extension\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2465"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client-extension\u2466"}], "title": "10.1. Client Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2467"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-client-extension\u2468"}, {"id": "ref-for-client-extension\u2460\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-client-extension\u2460\u2460"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-client-extension\u2460\u2461"}], "title": "10.2. Authenticator Extensions"}, {"refs": [{"id": "ref-for-client-extension\u2460\u2462"}, {"id": "ref-for-client-extension\u2460\u2463"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
 window.dfnpanelData['authenticator-extension'] = {"dfnID": "authenticator-extension", "url": "#authenticator-extension", "dfnText": "authenticator extension", "refSections": [{"refs": [{"id": "ref-for-authenticator-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-authenticator-extension\u2461"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-authenticator-extension\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authenticator-extension\u2463"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authenticator-extension\u2464"}, {"id": "ref-for-authenticator-extension\u2465"}, {"id": "ref-for-authenticator-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2467"}, {"id": "ref-for-authenticator-extension\u2468"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u24ea"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2460"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2461"}], "title": "10.2. Authenticator Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2462"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2463"}, {"id": "ref-for-authenticator-extension\u2460\u2464"}, {"id": "ref-for-authenticator-extension\u2460\u2465"}], "title": "11.1.1. Authenticator Extension Capabilities"}, {"refs": [{"id": "ref-for-authenticator-extension\u2460\u2466"}, {"id": "ref-for-authenticator-extension\u2460\u2467"}], "title": "11.2. Virtual Authenticators"}], "external": false};
 window.dfnpanelData['extension-identifier'] = {"dfnID": "extension-identifier", "url": "#extension-identifier", "dfnText": "extension identifier", "refSections": [{"refs": [{"id": "ref-for-extension-identifier"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-extension-identifier\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-extension-identifier\u2461"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-extension-identifier\u2462"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-extension-identifier\u2463"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-extension-identifier\u2464"}, {"id": "ref-for-extension-identifier\u2465"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-extension-identifier\u2466"}, {"id": "ref-for-extension-identifier\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-extension-identifier\u2468"}, {"id": "ref-for-extension-identifier\u2460\u24ea"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2460"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2461"}, {"id": "ref-for-extension-identifier\u2460\u2462"}, {"id": "ref-for-extension-identifier\u2460\u2463"}, {"id": "ref-for-extension-identifier\u2460\u2464"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2465"}, {"id": "ref-for-extension-identifier\u2460\u2466"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-extension-identifier\u2460\u2467"}, {"id": "ref-for-extension-identifier\u2460\u2468"}, {"id": "ref-for-extension-identifier\u2461\u24ea"}], "title": "9.5. Authenticator Extension Processing"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2460"}], "title": "11.2. Virtual Authenticators"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2461"}, {"id": "ref-for-extension-identifier\u2461\u2462"}], "title": "11.3. Add Virtual Authenticator"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2463"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-extension-identifier\u2461\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};
-window.dfnpanelData['client-extension-input'] = {"dfnID": "client-extension-input", "url": "#client-extension-input", "dfnText": "client extension input", "refSections": [{"refs": [{"id": "ref-for-client-extension-input"}], "title": "5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client-extension-input\u2460"}], "title": "5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client-extension-input\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-extension-input\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-extension-input\u2463"}], "title": "5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"}, {"refs": [{"id": "ref-for-client-extension-input\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-extension-input\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-extension-input\u2466"}, {"id": "ref-for-client-extension-input\u2467"}, {"id": "ref-for-client-extension-input\u2468"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u24ea"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u2460"}, {"id": "ref-for-client-extension-input\u2460\u2461"}, {"id": "ref-for-client-extension-input\u2460\u2462"}, {"id": "ref-for-client-extension-input\u2460\u2463"}, {"id": "ref-for-client-extension-input\u2460\u2464"}, {"id": "ref-for-client-extension-input\u2460\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u2466"}, {"id": "ref-for-client-extension-input\u2460\u2467"}, {"id": "ref-for-client-extension-input\u2460\u2468"}, {"id": "ref-for-client-extension-input\u2461\u24ea"}], "title": "9.4. Client Extension Processing"}], "external": false};
+window.dfnpanelData['client-extension-input'] = {"dfnID": "client-extension-input", "url": "#client-extension-input", "dfnText": "client extension input", "refSections": [{"refs": [{"id": "ref-for-client-extension-input"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-client-extension-input\u2460"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-client-extension-input\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-client-extension-input\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-client-extension-input\u2463"}], "title": "5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"}, {"refs": [{"id": "ref-for-client-extension-input\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-extension-input\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-extension-input\u2466"}, {"id": "ref-for-client-extension-input\u2467"}, {"id": "ref-for-client-extension-input\u2468"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u24ea"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u2460"}, {"id": "ref-for-client-extension-input\u2460\u2461"}, {"id": "ref-for-client-extension-input\u2460\u2462"}, {"id": "ref-for-client-extension-input\u2460\u2463"}, {"id": "ref-for-client-extension-input\u2460\u2464"}, {"id": "ref-for-client-extension-input\u2460\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-client-extension-input\u2460\u2466"}, {"id": "ref-for-client-extension-input\u2460\u2467"}, {"id": "ref-for-client-extension-input\u2460\u2468"}, {"id": "ref-for-client-extension-input\u2461\u24ea"}], "title": "9.4. Client Extension Processing"}], "external": false};
 window.dfnpanelData['authenticator-extension-input'] = {"dfnID": "authenticator-extension-input", "url": "#authenticator-extension-input", "dfnText": "authenticator extension input", "refSections": [{"refs": [{"id": "ref-for-authenticator-extension-input"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460"}, {"id": "ref-for-authenticator-extension-input\u2461"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2462"}, {"id": "ref-for-authenticator-extension-input\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2464"}, {"id": "ref-for-authenticator-extension-input\u2465"}, {"id": "ref-for-authenticator-extension-input\u2466"}, {"id": "ref-for-authenticator-extension-input\u2467"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2468"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460\u24ea"}, {"id": "ref-for-authenticator-extension-input\u2460\u2460"}, {"id": "ref-for-authenticator-extension-input\u2460\u2461"}, {"id": "ref-for-authenticator-extension-input\u2460\u2462"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460\u2463"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-authenticator-extension-input\u2460\u2464"}, {"id": "ref-for-authenticator-extension-input\u2460\u2465"}, {"id": "ref-for-authenticator-extension-input\u2460\u2466"}], "title": "9.5. Authenticator Extension Processing"}], "external": false};
 window.dfnpanelData['client-extension-processing'] = {"dfnID": "client-extension-processing", "url": "#client-extension-processing", "dfnText": "Client Extension Processing", "refSections": [{"refs": [{"id": "ref-for-client-extension-processing"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-client-extension-processing\u2460"}, {"id": "ref-for-client-extension-processing\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension-processing\u2462"}, {"id": "ref-for-client-extension-processing\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension-processing\u2464"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-client-extension-processing\u2465"}, {"id": "ref-for-client-extension-processing\u2466"}, {"id": "ref-for-client-extension-processing\u2467"}, {"id": "ref-for-client-extension-processing\u2468"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension-processing\u2460\u24ea"}], "title": "9.2. Defining Extensions"}], "external": false};
 window.dfnpanelData['client-extension-output'] = {"dfnID": "client-extension-output", "url": "#client-extension-output", "dfnText": "client extension output", "refSections": [{"refs": [{"id": "ref-for-client-extension-output"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-client-extension-output\u2460"}, {"id": "ref-for-client-extension-output\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension-output\u2462"}, {"id": "ref-for-client-extension-output\u2463"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-client-extension-output\u2464"}], "title": "5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"}, {"refs": [{"id": "ref-for-client-extension-output\u2465"}, {"id": "ref-for-client-extension-output\u2466"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-client-extension-output\u2467"}, {"id": "ref-for-client-extension-output\u2468"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-client-extension-output\u2460\u24ea"}, {"id": "ref-for-client-extension-output\u2460\u2460"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-client-extension-output\u2460\u2461"}, {"id": "ref-for-client-extension-output\u2460\u2462"}, {"id": "ref-for-client-extension-output\u2460\u2463"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-client-extension-output\u2460\u2464"}, {"id": "ref-for-client-extension-output\u2460\u2465"}, {"id": "ref-for-client-extension-output\u2460\u2466"}], "title": "9.4. Client Extension Processing"}, {"refs": [{"id": "ref-for-client-extension-output\u2460\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}], "external": false};