diff --git a/index.html b/index.html
index cbb74e7e4..bce061ea9 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 82ce88815, updated Thu Sep 7 16:33:55 2023 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="b59b425aa95abc7aa9215c82fd1b8873f0d50098" name="document-revision">
+  <meta content="d9bdee4d96a2d225907aee25190a965843e5b14d" name="document-revision">
 <style type="text/css">
 body {
     counter-reset: table;
@@ -914,7 +914,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2023-10-04">4 October 2023</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2023-10-06">6 October 2023</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -1193,6 +1193,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
       <li><a href="#sctn-fido-u2f-attestation"><span class="secno">8.6</span> <span class="content">FIDO U2F Attestation Statement Format</span></a>
       <li><a href="#sctn-none-attestation"><span class="secno">8.7</span> <span class="content">None Attestation Statement Format</span></a>
       <li><a href="#sctn-apple-anonymous-attestation"><span class="secno">8.8</span> <span class="content">Apple Anonymous Attestation Statement Format</span></a>
+      <li><a href="#sctn-compound-attestation"><span class="secno">8.9</span> <span class="content">Compound Attestation Statement Format</span></a>
      </ol>
     <li>
      <a href="#sctn-extensions"><span class="secno">9</span> <span class="content"><span>WebAuthn Extensions</span></span></a>
@@ -6611,6 +6612,41 @@ <h3 class="heading settled" data-level="8.8" id="sctn-apple-anonymous-attestatio
        <p>If successful, return implementation-specific values representing attestation type <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑤">Anonymization CA</a> and attestation trust path <var>x5c</var>.</p>
      </ol>
    </dl>
+   <h3 class="heading settled" data-level="8.9" id="sctn-compound-attestation"><span class="secno">8.9. </span><span class="content">Compound Attestation Statement Format</span><a class="self-link" href="#sctn-compound-attestation"></a></h3>
+   <p>The "compound" attestation statement format is used to pass multiple, self-contained attestation statements in a single ceremony.</p>
+   <dl>
+    <dt data-md>Attestation statement format identifier
+    <dd data-md>
+     <p>compound</p>
+    <dt data-md>Attestation types supported
+    <dd data-md>
+     <p>Any. See <a href="#sctn-attestation-types">§ 6.5.4 Attestation Types</a>.</p>
+    <dt data-md>Syntax
+    <dd data-md>
+     <p>The syntax of a compound attestation statement is defined as follows:</p>
+<pre>$$attStmtType //= (
+                      fmt: "compound",
+                      attStmt: [2* nonCompoundAttStmt]
+                  )
+
+nonCompoundAttStmt = { $$attStmtType } .within { fmt: text .ne "compound" }
+</pre>
+    <dt data-md>Signing procedure
+    <dd data-md>
+     <p>Not applicable</p>
+    <dt data-md>Verification procedure
+    <dd data-md>
+     <p>Given the <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑤">verification procedure inputs</a> <var>attStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>, the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedure</a> is
+as follows:</p>
+     <ol>
+      <li data-md>
+       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">For each</a> <var>subStmt</var> of <var>attStmt</var>, evaluate the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> corresponding to the <a data-link-type="dfn" href="#attestation-statement-format-identifier" id="ref-for-attestation-statement-format-identifier⑤">attestation statement format identifier</a> <code><var>subStmt</var>.fmt</code> with <a data-link-type="dfn" href="#verification-procedure-inputs" id="ref-for-verification-procedure-inputs⑥">verification procedure inputs</a> <var>subStmt</var>, <var>authenticatorData</var> and <var>clientDataHash</var>.</p>
+       <p>If validation fails for one or more <var>subStmt</var>, decide the appropriate result based on <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> policy.</p>
+      <li data-md>
+       <p>If sufficiently many (as determined by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> policy) <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①③">items</a> of <var>attStmt</var> verify successfully,
+return implementation-specific values representing any combination of outputs from successful <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedures</a>.</p>
+     </ol>
+   </dl>
    <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="secno">9. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-extensions">WebAuthn Extensions</dfn></span><a class="self-link" href="#sctn-extensions"></a></h2>
    <p>The mechanism for generating <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credentials</a>, as well as requesting and generating Authentication assertions, as
 defined in <a href="#sctn-api">§ 5 Web Authentication API</a>, can be extended to suit particular use cases. Each case is addressed by defining a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="registration extension" data-noexport id="registration-extension">registration
@@ -6626,7 +6662,7 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
      <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
    <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> call
 (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a>.
 The <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
@@ -6646,9 +6682,9 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
 Since <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> is returned as part of the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤①">authenticator data</a>, authenticator extensions
 MAY also specify an <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs">unsigned extension output</a>, e.g. for cases where an output itself depends on <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤②">authenticator data</a>.
 Part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> and <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs①">unsigned extension output</a> as an input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
    <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a> MUST be defined in such a way that lack of support for them by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a> does not endanger the user’s security or privacy.
 For instance, if an extension requires client processing, it could be defined in a manner that ensures
@@ -6681,7 +6717,7 @@ <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> value.
 Extensions MAY specify <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs②">unsigned extension outputs</a>.</p>
    <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> know that the extension was honored by the authenticator. If an
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
 output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
@@ -6691,7 +6727,7 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑤">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
 passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">get()</a></code> call.
 The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
@@ -6710,8 +6746,8 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
 <c- p>});</c->
 </pre>
    <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Party</a>.</p>
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
 authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension
 input</a>,
@@ -6759,11 +6795,11 @@ <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions
    <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
    <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid" title="FIDO AppID and Facet Specification">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
 order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
      <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> option
@@ -6786,8 +6822,8 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
 but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a> might be "example.com".</p>
    <dl>
@@ -6834,7 +6870,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appid"></a></dfn>;
 };
@@ -6851,7 +6887,7 @@ <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span
    </dl>
    <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
    <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi" title="FIDO U2F JavaScript API">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -6890,7 +6926,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
        <p>Just prior to <a href="#CreateCred-InvokeAuthnrMakeCred">invoking authenticatorMakeCredential</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⑤">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
+         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⑤">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
          <ol>
           <li data-md>
            <p>Check whether <var>C</var> was created using U2F on <var>authenticator</var> by sending a <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> whose "five parts" are set to the following values:</p>
@@ -6926,7 +6962,7 @@ <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appidexclude"></a></dfn>;
 };
@@ -6953,7 +6989,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-credprops"></a></dfn>;
 };
@@ -6981,7 +7017,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
+        <p class="note" role="note"><span class="marker">Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑦">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential④">non-discoverable credential</a>.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension input
@@ -6995,11 +7031,11 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
      <p>None.</p>
    </dl>
    <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪">BufferSource</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></code>s.</p>
    <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
    <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
    <p>The <code>hmac-secret</code> extension provides two PRFs per credential: one which is used for requests where <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a> is performed and another for all other requests. This extension only exposes a single PRF per credential and, when implementing on top of <code>hmac-secret</code>, that PRF MUST be the one used for when <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> is performed. This overrides the <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> if neccessary.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> is identical.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -7085,7 +7121,7 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </ol>
     <dt data-md>Authenticator extension input / processing / output
     <dd data-md>
-     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
@@ -7109,9 +7145,9 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
      </div>
    </dl>
    <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span class="marker">Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob">large, per-credential blobs</a>.</p>
    <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑧">discoverable credentials</a>,
@@ -7148,10 +7184,10 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
         <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⑤">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
       </dl>
      </div>
     <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
@@ -7251,7 +7287,7 @@ <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Parties</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
    <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
@@ -7266,7 +7302,7 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
      <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">Authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
   <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②⓪"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-uvm"></a></dfn>;
 };
@@ -7346,19 +7382,19 @@ <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span cl
 </pre>
    </dl>
    <h4 class="heading settled" data-level="10.2.2" id="sctn-device-publickey-extension"><span class="secno">10.2.2. </span><span class="content">Device-bound public key extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="devicepubkey">devicePubKey</dfn>)</span><a class="self-link" href="#sctn-device-publickey-extension"></a></h4>
-   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> with a "device continuity" signal for <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials. This is done by creating a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>-specific <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair②">hardware-bound device key pair</a> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a>, if such a key pair does not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credential</a> being created or exercised, and returning the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key">device public key</a> along with a signature by the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key①">device private key</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey③">devicePubKey</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
+   <p>This <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> provides a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a> with a "device continuity" signal for <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible②">backup eligible</a> credentials. This is done by creating a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①">user credential</a>-specific <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair②">hardware-bound device key pair</a> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a>, if such a key pair does not already exist for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential②">user credential</a> being created or exercised, and returning the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key">device public key</a> along with a signature by the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key①">device private key</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a>. This is done each time this <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey③">devicePubKey</a> extension is included with either a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑦">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑨">navigator.credentials.get()</a></code> call.</p>
    <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> is incapable of generating a <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair③">hardware-bound device key pair</a>, or the registration or authentication operation fails for any reason, this extension is ignored and no <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair④">hardware-bound device key pair</a> is created. In this case, there is no <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey④">devicePubKey</a> extension output generated.</p>
    <p>The <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑤">hardware-bound device key pair</a> is not on its own a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential③">user credential</a> and does not have its own <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a>. Instead, the returned <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①">device public key</a> is a device-specific contextual attribute of its associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential④">user credential</a>. That is, when that <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑤">user credential</a> is used—along with the <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑤">devicePubKey</a> extension—on a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a>, a particular <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key②">device public key</a> is returned by the extension, along with a signature demonstrating proof-of-possession of the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key②">device private key</a> by that device.</p>
    <h5 class="heading settled" data-level="10.2.2.1" id="sctn-device-publickey-extension-usage"><span class="secno">10.2.2.1. </span><span class="content">Relying Party Usage</span><a class="self-link" href="#sctn-device-publickey-extension-usage"></a></h5>
-   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension provides a "device continuity" signal <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations:</p>
-   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Party</a> uses the <code>devicePubKey</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>, a signature by a new <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①">device-bound key</a> ("dpk 1") is returned along with the new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key③">device public key</a>. Even if the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>, "dpk 1" never leaves the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator⑤">generating authenticator</a> ("authenticator 1"). The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations using the same user credential with that <i>same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a></i> generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertions</a> including further signatures by the <i>same</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key②">device-bound key</a> ("dpk 1"). This behavior on "authenticator 1" is independent of whether this user credential has been copied to any other <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a>.</p>
-   <p>Then, if this same user credential is copied to a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator</a> ("authenticator 2"), the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>'s first <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> call on "authenticator 2" (that includes the <code>devicePubKey</code> extension) will produce an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> including a signature by a <i>new</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key③">device-bound key</a> ("dpk 2"). Note that such a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a> can be exercised on "authenticator 2" without a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">create()</a></code> having been performed on "authenticator 2". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> calls on "authenticator 2", using the <code>devicePubKey</code> extension and the same user credential, yield further signatures by "dpk 2".</p>
+   <p>This extension is intended for use by those <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Parties</a> employing risk-analysis systems informing their sign-in decisions. This extension provides a "device continuity" signal <i>when used consistently</i> with both <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑧">navigator.credentials.create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⓪">navigator.credentials.get()</a></code> operations:</p>
+   <p>When a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a> uses the <code>devicePubKey</code> extension with a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⑨">create()</a></code> call to create a new <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑥">user credential</a>, a signature by a new <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①">device-bound key</a> ("dpk 1") is returned along with the new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key③">device public key</a>. Even if the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑦">user credential</a> is <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>, "dpk 1" never leaves the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator⑤">generating authenticator</a> ("authenticator 1"). The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④①">get()</a></code> operations using the same user credential with that <i>same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a></i> generate <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertions</a> including further signatures by the <i>same</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key②">device-bound key</a> ("dpk 1"). This behavior on "authenticator 1" is independent of whether this user credential has been copied to any other <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticator</a>.</p>
+   <p>Then, if this same user credential is copied to a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator</a> ("authenticator 2"), the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a>'s first <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④②">get()</a></code> call on "authenticator 2" (that includes the <code>devicePubKey</code> extension) will produce an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> including a signature by a <i>new</i> <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key③">device-bound key</a> ("dpk 2"). Note that such a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credential</a> can be exercised on "authenticator 2" without a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④⓪">create()</a></code> having been performed on "authenticator 2". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a>'s subsequent <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④③">get()</a></code> calls on "authenticator 2", using the <code>devicePubKey</code> extension and the same user credential, yield further signatures by "dpk 2".</p>
    <p>A usage example is thus:</p>
    <blockquote>
     <p>Say that a sign-in request appears at a website along with some geolocation signal that has not been seen for this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a> before, and is outside of the typical usage hours observed for the account. The risk may be deemed high enough not to allow the request, even with an assertion by a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑧">multi-device credential</a> on its own. But if a signature by a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key④">device-bound key</a> that is <i>well established</i> for this user can also be presented, then that may tip the balance.</p>
    </blockquote>
-   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Parties</a> need to take care to verify <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑤">device-bound key</a> signatures before associating and storing extension output value fields in conjunction with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. See <a href="#sctn-device-publickey-extension-verification">§ 10.2.2.3 devicePubKey Extension Output Verification Procedures</a>.</p>
-   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Parties</a> give to the presence of a signature from a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑥">device-bound key</a> may be based on information learned from its optional attestation. An attestation can indicate the level of protection that the hardware offers the private key, certifications for the hardware, etc.</p>
+   <p class="note" role="note"><span class="marker">Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a> need to take care to verify <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑤">device-bound key</a> signatures before associating and storing extension output value fields in conjunction with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>. See <a href="#sctn-device-publickey-extension-verification">§ 10.2.2.3 devicePubKey Extension Output Verification Procedures</a>.</p>
+   <p>The weight that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Parties</a> give to the presence of a signature from a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑥">device-bound key</a> may be based on information learned from its optional attestation. An attestation can indicate the level of protection that the hardware offers the private key, certifications for the hardware, etc.</p>
    <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-extension-definition"><span class="secno">10.2.2.2. </span><span class="content">Extension Definition</span><a class="self-link" href="#sctn-device-publickey-extension-definition"></a></h5>
    <dl>
     <dt data-md>Extension identifier
@@ -7382,12 +7418,12 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
       <dl>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsdevicepublickeyinputs-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑥">DOMString</a>, defaulting to <code>"none"</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance⑤">attestation conveyance</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance⑤">attestation conveyance</a>.
 Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference⑤">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑧">member does not exist</a>.</p>
         <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none⑦">none</a></code>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsDevicePublicKeyInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsdevicepublickeyinputs-attestationformats"><code>attestationFormats</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦⑦">DOMString</a>>, defaulting to <code>[]</code></span>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a>.
+        <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑤">attestation</a> statement format used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a>.
 Values SHOULD be taken from the IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries" title="Web Authentication (WebAuthn) registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809" title="Registries for Web Authentication (WebAuthn)">[RFC8809]</a>.
 Values are ordered from most preferable to least preferable.
 This parameter is advisory and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a> MAY use an attestation statement not enumerated in this parameter.</p>
@@ -7516,7 +7552,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
          <p><var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑤">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats①">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①⓪">AAGUID</a>. (Since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑦">hardware-bound device key pair</a> is specific to a particular authenticator, its attestation can be tied to hardware roots of trust, although they do not have to be. This is in contrast to the associated <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential⑨">user credential</a>'s attestation, if it is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①⓪">multi-device credential</a>.)</p>
         <dt data-md>enterprise
         <dd data-md>
-         <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then <var>attFormat</var> is "none" and <var>attAaguid</var> is 16 zero bytes. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑥">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①①">AAGUID</a>. (Again, since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑧">hardware-bound device key pair</a> is specific to a particular authenticator, the attestation may be tied to hardware roots of trust.)</p>
+         <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">Authenticators</a> MUST NOT provide such an attestation unless the user agent or authenticator configuration expressly permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>. If <i>not</i> permitted, then <var>attFormat</var> is "none" and <var>attAaguid</var> is 16 zero bytes. Otherwise <var>attFormat</var> is an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑥">attestation statement format</a> appropriate for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> based on <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyinputs-attestationformats" id="ref-for-dom-authenticationextensionsdevicepublickeyinputs-attestationformats②">attestationFormats</a></code>, and <var>attAaguid</var> is the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator’s</a> <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①①">AAGUID</a>. (Again, since the <a data-link-type="dfn" href="#hardware-bound-device-key-pair" id="ref-for-hardware-bound-device-key-pair⑧">hardware-bound device key pair</a> is specific to a particular authenticator, the attestation may be tied to hardware roots of trust.)</p>
          <p class="note" role="note"><span class="marker">Note:</span> CTAP2 does not currently provide for an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#makecred-enterpriseattestation">enterpriseAttestation</a> signal during an <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#authenticatorGetAssertion">authenticatorGetAssertion</a> call. Until that is changed, <a href="https://fidoalliance.org/specs/fido-v2.1-ps-20210615/fido-client-to-authenticator-protocol-v2.1-ps-20210615.html#platform-managed-enterprise-attestation">platform-managed enterprise attestation</a> will not work in that context with CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a>.</p>
        </dl>
       <li data-md>
@@ -7546,7 +7582,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
        </ol>
       <li data-md>
        <p>Let <var>dpkSig</var> be the result of signing the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①⓪">assertion signature</a> <a href="#fig-signature">input</a> with <var>devicePrivateKey</var>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>dpkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a> knows that <var>dpkSig</var> is a fresh signature.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①①">assertion signature</a> <a href="#fig-signature">input</a>, and thus <var>dpkSig</var>, covers the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> because it includes the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②①">hash of the serialized client data</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> knows that <var>dpkSig</var> is a fresh signature.</p>
       <li data-md>
        <p>Output <var>dpkSig</var> as the extension’s <a data-link-type="dfn" href="#unsigned-extension-outputs" id="ref-for-unsigned-extension-outputs⑦">unsigned extension output</a>.</p>
        <p class="note" role="note"><span class="marker">Note:</span> <var>dpkSig</var> cannot be included in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑧">authenticator extension output</a> because it is returned inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑦">authenticator data</a> and that would imply that the signature signs over itself.</p>
@@ -7555,7 +7591,7 @@ <h5 class="heading settled" data-level="10.2.2.2" id="sctn-device-publickey-exte
    <h6 class="heading settled" data-level="10.2.2.2.1" id="sctn-device-publickey-attestation-aaguid"><span class="secno">10.2.2.2.1. </span><span class="content">AAGUIDs</span><a class="self-link" href="#sctn-device-publickey-attestation-aaguid"></a></h6>
    <p>The <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①②">AAGUID</a> included in the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑥">devicePubKey</a></code> extension output, if non-zero, identifies the make or model of hardware that is storing the <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key⑨">device-bound key</a>. This is distinct from the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①③">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⑧">attested credential data</a> of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①②">multi-device credential</a>, which likely identifies something broader since such credentials are not bound to a single device. Thus the two AAGUIDs MAY be different in a single response and either, or both, may be zero depending on the options requested and authenticator behaviour.</p>
    <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-device-publickey-attestation-calculations"><span class="secno">10.2.2.2.2. </span><span class="content">Attestation calculations</span><a class="self-link" href="#sctn-device-publickey-attestation-calculations"></a></h6>
-   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⓪">device-bound key</a>, the typical value for <code>hash</code> hashes over the attestation signature itself, which is impossible. Also the attestation of a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①①">device-bound key</a> is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
+   <p>When computing attestations, the process in <a href="#sctn-generating-an-attestation-object">§ 6.5.5 Generating an Attestation Object</a> takes two inputs: <code>authData</code> and <code>hash</code>. When calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①⓪">device-bound key</a>, the typical value for <code>hash</code> hashes over the attestation signature itself, which is impossible. Also the attestation of a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①①">device-bound key</a> is potentially used repeatedly, thus may want to be cached. But signing over values that include <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a>-chosen nonces, like the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②②">hash of the serialized client data</a>, makes that impossible.</p>
    <p>Therefore when calculating an attestation for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①②">device-bound key</a>, the inputs are:</p>
    <ul>
     <li data-md>
@@ -7566,7 +7602,7 @@ <h6 class="heading settled" data-level="10.2.2.2.2" id="sctn-device-publickey-at
    <p>The attestation signature is thus typically calculated over the bytes of <code>(h’64657669636520626f756e64206b6579206174746573746174696f6e2073696700ffffffff' || <var>aaguid</var> || <var>dpk</var> || <var>nonce</var>)</code>. The 37-byte prefix ensures domain separation: it takes the place of the RP ID hash, flags, and signature counter fields in those messages and ensures that no attestation signature for a <a data-link-type="dfn" href="#device-bound-key" id="ref-for-device-bound-key①③">device-bound key</a> can be confused with a signature for a <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①②">user credential</a>.</p>
    <p>Note that when <var>nonce</var> is empty, then the (signed) authenticator extension output MAY be constant. However, the (unsigned) <var>dpkSig</var> output is always unique and prevents replay of the (signed) extension output without knowledge of the <a data-link-type="dfn" href="#device-private-key" id="ref-for-device-private-key④">device private key</a>.</p>
    <h5 class="heading settled" data-level="10.2.2.3" id="sctn-device-publickey-extension-verification"><span class="secno">10.2.2.3. </span><span class="content"><code>devicePubKey</code> Extension Output Verification Procedures</span><a class="self-link" href="#sctn-device-publickey-extension-verification"></a></h5>
-   <p>Verifying the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑦">devicePubKey</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> whenever a <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑥">device public key</a> is returned within the extension output.</p>
+   <p>Verifying the <code><a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑦">devicePubKey</a></code> extension output is performed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> whenever a <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑥">device public key</a> is returned within the extension output.</p>
    <p>The <a data-link-type="dfn" href="#devicepubkey" id="ref-for-devicepubkey⑧">devicePubKey</a> extension adds the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> to <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①③">credential records</a>:</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="abstract-op" data-export id="abstract-opdef-credential-record-devicepubkeys">devicePubKeys</dfn>
@@ -7594,8 +7630,8 @@ <h5 class="heading settled" data-level="10.2.2.3" id="sctn-device-publickey-exte
      </dl>
    </dl>
    <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-extension-verification-create"><span class="secno">10.2.2.3.1. </span><span class="content">Registration (<code>create()</code>)</span><a class="self-link" href="#sctn-device-publickey-extension-verification-create"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code> call,
-then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④①">navigator.credentials.create()</a></code> call,
+then the below verification steps are performed in the context of <a href="#reg-ceremony-verify-extension-outputs">step 19</a> of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, and <var>hash</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientoutputs-devicepubkey">devicePubKey</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature">signature</a></code> field.</p>
@@ -7607,7 +7643,7 @@ <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-ex
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature①">signature</a></code> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①②">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑦">device public key</a> <var>dpk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①③">user credential</a>.)</p>
     <li data-md>
-     <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑨">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①④">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+     <p>Optionally, if attestation was requested and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑦">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②⑨">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑦">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
      <p class="note" role="note"><span class="marker">Note:</span> If <var>fmt</var>’s value is "<a data-link-type="dfn" href="#none" id="ref-for-none⑧">none</a>" there is no attestation signature to verify.</p>
     <li data-md>
      <p>Create a new <a data-link-type="dfn" href="#credential-record-device-bound-key-record" id="ref-for-credential-record-device-bound-key-record①">device-bound key record</a> with the contents:</p>
@@ -7633,8 +7669,8 @@ <h6 class="heading settled" data-level="10.2.2.3.1" id="sctn-device-publickey-ex
    </ol>
    <p>See also <a href="#sctn-device-publickey-extension-usage">§ 10.2.2.1 Relying Party Usage</a> for further details.</p>
    <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-extension-verification-get"><span class="secno">10.2.2.3.2. </span><span class="content">Authentication (<code>get()</code>)</span><a class="self-link" href="#sctn-device-publickey-extension-verification-get"></a></h6>
-   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> call,
-then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 17</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
+   <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> requested the <code>devicePubKey</code> extension in a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑤">navigator.credentials.get()</a></code> call,
+then the below verification steps are performed in the context of <a href="#authn-ceremony-verify-extension-outputs">step 17</a> of <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> using these variables established therein: <var>credential</var>, <var>clientExtensionResults</var>, <var>authData</var>, <var>hash</var>, and <var>credentialRecord</var>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy may specify whether a response without a <code>devicePubKey</code> extension output is acceptable.</p>
    <ol>
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-devicepubkey" id="ref-for-dom-authenticationextensionsclientoutputs-devicepubkey①">devicePubKey</a></code> member of <var>clientExtensionResults</var> exists, and contains the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature②">signature</a></code> field.</p>
@@ -7646,7 +7682,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
     <li data-md>
      <p>Verify that <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsdevicepublickeyoutputs-signature" id="ref-for-dom-authenticationextensionsdevicepublickeyoutputs-signature③">signature</a></code> is a valid signature over the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature①③">assertion signature</a> <a href="#fig-signature">input</a> (i.e. <code>authData</code> and <code>hash</code>) by the <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key⑧">device public key</a> <var>dpk</var>. (The signature algorithm is the same as for the <a data-link-type="dfn" href="#user-credential" id="ref-for-user-credential①④">user credential</a>.)</p>
     <li data-md>
-     <p>Let <var>matchedDpkRecords</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②⓪">For each</a> <var>dpkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys①">devicePubKeys</a>:</p>
+     <p>Let <var>matchedDpkRecords</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑦">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑧">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">For each</a> <var>dpkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys①">devicePubKeys</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-aaguid" id="ref-for-abstract-opdef-devicepubkey-record-aaguid①">aaguid</a> equals <var>aaguid</var>, <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-dpk" id="ref-for-abstract-opdef-devicepubkey-record-dpk①">dpk</a> equals <var>dpk</var>,
@@ -7674,7 +7710,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
          <p class="note" role="note"><span class="marker">Note:</span> This authenticator is not generating a fresh per-response random nonce.</p>
         <dt data-md>does not equal <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-attstmt" id="ref-for-abstract-opdef-devicepubkey-record-attstmt②">attStmt</a> by binary equality:
         <dd data-md>
-         <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③⓪">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑤">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+         <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑧">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③⓪">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑧">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
          <p>If the result is:</p>
          <dl class="switch">
           <dt data-md>successful
@@ -7690,7 +7726,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
        <p>This is possibly a new <a data-link-type="dfn" href="#device-public-key" id="ref-for-device-public-key①②">device public key</a> signifying a new device.</p>
        <ol>
         <li data-md>
-         <p>Let <var>matchedDpkKeys</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑨">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑨">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②①">For each</a> <var>dpkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys②">devicePubKeys</a>:</p>
+         <p>Let <var>matchedDpkKeys</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑨">empty</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑨">set</a>. <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate②②">For each</a> <var>dpkRecord</var> in <var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-devicepubkeys" id="ref-for-abstract-opdef-credential-record-devicepubkeys②">devicePubKeys</a>:</p>
          <ol>
           <li data-md>
            <p>If <var>dpkRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-devicepubkey-record-dpk" id="ref-for-abstract-opdef-devicepubkey-record-dpk②">dpk</a> equals <var>dpk</var>:</p>
@@ -7704,10 +7740,10 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
          <dl class="switch">
           <dt data-md>If <var>fmt</var>’s value is "none":
           <dd data-md>
-           <p>There is no attestation signature to verify and this is a new device. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-device-bound-key-record" id="ref-for-abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</a> and then terminate these verification steps.</p>
+           <p>There is no attestation signature to verify and this is a new device. Unless <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> policy specifies that this attestation is unacceptable, <a data-link-type="abstract-op" href="#abstract-opdef-create-a-new-device-bound-key-record" id="ref-for-abstract-opdef-create-a-new-device-bound-key-record">Create a new device-bound key record</a> and then terminate these verification steps.</p>
           <dt data-md>Otherwise:
           <dd data-md>
-           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑥">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
+           <p>Optionally, if attestation was requested and the RP wishes to verify it, verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⑨">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②⓪">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③①">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①⑨">verification procedure</a> given <var>attStmt</var>. See <a href="#sctn-device-publickey-attestation-calculations">§ 10.2.2.2.2 Attestation calculations</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> policy may specifiy which attestations are acceptable.</p>
            <p>If the result is:</p>
            <dl class="switch">
             <dt data-md>successful
@@ -7719,7 +7755,7 @@ <h6 class="heading settled" data-level="10.2.2.3.2" id="sctn-device-publickey-ex
            </dl>
          </dl>
         <li data-md>
-         <p>Otherwise there is some form of error: we recieved a known <var>dpk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a> has stored along with that <var>dpk</var> value. Terminate these verification steps.</p>
+         <p>Otherwise there is some form of error: we recieved a known <var>dpk</var> value, but one or more of the accompanying <var>aaguid</var> or <var>scope</var> values did not match what the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a> has stored along with that <var>dpk</var> value. Terminate these verification steps.</p>
        </ol>
      </dl>
    </ol>
@@ -8358,7 +8394,7 @@ <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span cla
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⑥">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②③">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
@@ -8366,15 +8402,15 @@ <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><s
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
 The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑥">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
 The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Parties</a> as to their provenance.</p>
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⑦">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref" title="FIDO Security Reference">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
 Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs" title="FIDO Authenticator Security Requirements">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
    <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a> is not signed.
@@ -8395,7 +8431,7 @@ <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-prox
 then the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a> has to trust the third party to
 enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> for other users.</p>
    <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a>,
 or where <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> do not communicate directly,
@@ -8417,38 +8453,38 @@ <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span cl
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
 manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
 scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⓪">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
    <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> can optionally
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a> can optionally
 enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤①">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticators</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
 Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> - for example PIN, biometrics and/or future
 methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑥">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
 to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①③">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge④">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
    <p>In order to prevent replay attacks, the challenges MUST contain enough entropy to make guessing them infeasible. Challenges SHOULD
@@ -8459,88 +8495,88 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
 may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> qualities.
 For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
 However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤③">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑤">attestation object</a> was generated
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑤">attestation object</a> was generated
 by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②⑥">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
    <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> maintains
 confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
    <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑦">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a>: unscathed
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> reports
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑨">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> reports
 a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span class="marker">Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> also
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> also
 un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> that were registered
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> in order to un-register
 related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> was performed after revocation of such certificates.</p>
    <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
    <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticators</a>.
 In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
 multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
 different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①①">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument risks leaking information
 about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
 For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a>,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user accounts</a>,
 and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user accounts</a>.
 The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑤">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
    <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
-   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
-which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Parties</a>.</p>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a>.</p>
    <p>Code injection can happen in several ways;
 this section attempts to point out some likely scenarios and suggest suitable mitigations,
 but is not an exhaustive list.</p>
    <ul>
     <li data-md>
-     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>,
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a>,
 either intentionally or due to a security vulnerability in the third party.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2" title="Content Security Policy Level 2">[CSP2]</a>,
 and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a>.</p>
     <li data-md>
      <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a>.
 For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤①">RP ID</a> <code>example.org</code>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
 malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> and impersonate the victims of the attack.</p>
-     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
-If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
    </ul>
    <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><span class="secno">13.4.9. </span><span class="content">Validating the origin of a credential</span><a class="self-link" href="#sctn-validating-origin"></a></h4>
    <p>When <a href="#rp-op-registering-a-new-credential-step-origin">registering a credential</a> and
 when <a href="#rp-op-verifying-assertion-step-origin">verifying an assertion</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
-   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨④">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a> MUST validate the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①②">origin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①④">client data</a>.</p>
+   <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a> MUST NOT accept unexpected values of <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①③">origin</a></code>,
 as doing so could allow a malicious website to obtain valid <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credentials</a>.
 Although the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scope</a> of <a data-link-type="dfn">WebAuthn credentials</a> prevents their use on domains
 outside the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤②">RP ID</a> they were registered for,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑤">Relying Party</a>'s origin validation serves as an additional layer of protection
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a>'s origin validation serves as an additional layer of protection
 in case a faulty <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a> fails to enforce credential <a data-link-type="dfn" href="#scope" id="ref-for-scope③⓪">scope</a>.
 See also <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for discussion of potentially malicious subdomains.</p>
-   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑥">Relying Party</a>.
+   <p>Validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -8555,11 +8591,11 @@ <h4 class="heading settled" data-level="13.4.9" id="sctn-validating-origin"><spa
      <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-code-injection">§ 13.4.8 Code injection attacks</a> for a discussion of the risks of allowing any subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⑤">RP ID</a>.</p>
     <li data-md>
      <p>A web application with a companion native application might allow <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑧">origin</a></code> to be an operating system dependent
-identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑦">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
+identifier for the native application. For example, such a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a> might require that <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⑨">origin</a></code> exactly equals some element of the list <code>["https://example.org", "example-os:appid:204ffa1a5af110ac483f131a1bef8a841a7adb0d8d135908bbd964ed05d2653b"]</code>.</p>
    </ul>
    <p>Similar considerations apply when validating the <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①①">topOrigin</a></code> member of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①⑤">client data</a>.
-When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑧">Relying Party</a> MUST validate that its value is expected.
-This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⑨">Relying Party</a>.
+When <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-toporigin" id="ref-for-dom-collectedclientdata-toporigin①②">topOrigin</a></code> is present, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> MUST validate that its value is expected.
+This validation MAY be performed by exact string matching or any other method as needed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a>.
 For example:</p>
    <ul>
     <li data-md>
@@ -8577,7 +8613,7 @@ <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><sp
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles" title="FIDO Privacy Principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -8591,53 +8627,53 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
      <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
 private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary" title="Information technology — Vocabulary — Biometrics">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a>, but in
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a>, but in
 the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> depending on the implementation.</p>
     <li data-md>
      <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticator</a>.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤⑤">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticator</a>.</p>
     <li data-md>
      <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①②">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑤">Relying Party</a>.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①③">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑥">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑦">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Parties</a> from using it to discover a user’s personal identity.</p>
    <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
    <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑧">Relying Parties</a>.</p>
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Parties</a>.</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑦">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⑨">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⓪">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope③①">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①①">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①②">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①④">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Parties</a> thus cannot correlate users between their
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑤">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑥">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑦">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑧">authenticators</a>.</p>
    </ul>
    <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑥">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑦">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Parties</a>.</p>
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑧">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
    <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
 authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①①⓪">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑥">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Party</a>.</p>
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑧">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⑥">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a>.</p>
    <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③②⓪">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
@@ -8673,72 +8709,72 @@ <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span clas
    <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①①③">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③③">authenticator</a>:</p>
    <ul>
     <li data-md>
      <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③④">authenticators</a> are present.</p>
     <li data-md>
      <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑤">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑥">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑤">Relying Party</a> could identify the user by probing for
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> could identify the user by probing for
 which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑥">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑦">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑧">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
 timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑦">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤④">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
     <li data-md>
      <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑧">Relying Party</a> could identify the user by probing
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Party</a> could identify the user by probing
 for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
 failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⑨">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
 one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> parameter is
 available to the user.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
    <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑧">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⓪">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
    <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
 and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③③⑨">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑨">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥②">user verification</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
 addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③⓪">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a>, since hashing does not prevent probing for guessable input
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④④">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
    <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⑤">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③③">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③④">Relying Party</a> responds with a failure, but then
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a> responds with a failure, but then
 successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑤">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⑤">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑥">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a> may implement to mitigate or prevent information
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑦">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⑤">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
      <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑧">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③⑨">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⓪">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④①">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④②">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④③">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
@@ -8758,7 +8794,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
 ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④⑥">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①⑤">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
        <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④④">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span class="marker">Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span class="marker">Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
     are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> member could therefore be populated with pseudo-random values
@@ -8775,17 +8811,17 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑤">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①②">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③④">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
    <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑤">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑥">Relying Parties</a>,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Parties</a>,
 but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④①">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑦">Relying Parties</a>,
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④②">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Parties</a>,
 so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑥">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
 Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
 given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑧">Relying Party</a> could for example:</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
@@ -8797,11 +8833,11 @@ <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-l
    </ul>
    <p>If the above prevention measures are not available,
 i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⑧">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④④⑨">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⑤">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
    <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④④">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤⓪">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤①">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤②">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑥">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑦">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑤③">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> MAY adjust the timeout accordingly.</p>
    <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span class="secno">16. </span><span class="content">Acknowledgements</span><a class="self-link" href="#sctn-acknowledgements"></a></h2>
     We thank the following people for their reviews of, and contributions to, this specification:
 Yuriy Ackermann,
@@ -11027,11 +11063,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['03afaf9c'] = {"dfnID": "03afaf9c", "url": "https://infra.spec.whatwg.org/#list-empty", "dfnText": "empty", "refSections": [{"refs": [{"id": "ref-for-list-empty"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-empty\u2460"}, {"id": "ref-for-list-empty\u2461"}, {"id": "ref-for-list-empty\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-empty\u2463"}, {"id": "ref-for-list-empty\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-empty\u2465"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-list-empty\u2466"}, {"id": "ref-for-list-empty\u2467"}, {"id": "ref-for-list-empty\u2468"}, {"id": "ref-for-list-empty\u2460\u24ea"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-list-empty\u2460\u2460"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-list-empty\u2460\u2461"}], "title": "14.6.3. Privacy leak via credential IDs"}], "external": true};
 window.dfnpanelData['8958b003'] = {"dfnID": "8958b003", "url": "https://infra.spec.whatwg.org/#map-entry", "dfnText": "entry", "refSections": [{"refs": [{"id": "ref-for-map-entry"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-entry\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['1243a891'] = {"dfnID": "1243a891", "url": "https://infra.spec.whatwg.org/#map-exists", "dfnText": "exist", "refSections": [{"refs": [{"id": "ref-for-map-exists"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-map-exists\u2460"}, {"id": "ref-for-map-exists\u2461"}, {"id": "ref-for-map-exists\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-map-exists\u2463"}, {"id": "ref-for-map-exists\u2464"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-map-exists\u2465"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-map-exists\u2466"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-map-exists\u2467"}], "title": "10.2.2.2. Extension Definition"}], "external": true};
-window.dfnpanelData['16d07e10'] = {"dfnID": "16d07e10", "url": "https://infra.spec.whatwg.org/#list-iterate", "dfnText": "for each (for list)", "refSections": [{"refs": [{"id": "ref-for-list-iterate"}, {"id": "ref-for-list-iterate\u2460"}, {"id": "ref-for-list-iterate\u2461"}, {"id": "ref-for-list-iterate\u2462"}, {"id": "ref-for-list-iterate\u2463"}, {"id": "ref-for-list-iterate\u2464"}, {"id": "ref-for-list-iterate\u2465"}, {"id": "ref-for-list-iterate\u2466"}, {"id": "ref-for-list-iterate\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2468"}, {"id": "ref-for-list-iterate\u2460\u24ea"}, {"id": "ref-for-list-iterate\u2460\u2460"}, {"id": "ref-for-list-iterate\u2460\u2461"}, {"id": "ref-for-list-iterate\u2460\u2462"}, {"id": "ref-for-list-iterate\u2460\u2463"}, {"id": "ref-for-list-iterate\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2466"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2468"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u24ea"}, {"id": "ref-for-list-iterate\u2461\u2460"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
+window.dfnpanelData['16d07e10'] = {"dfnID": "16d07e10", "url": "https://infra.spec.whatwg.org/#list-iterate", "dfnText": "for each (for list)", "refSections": [{"refs": [{"id": "ref-for-list-iterate"}, {"id": "ref-for-list-iterate\u2460"}, {"id": "ref-for-list-iterate\u2461"}, {"id": "ref-for-list-iterate\u2462"}, {"id": "ref-for-list-iterate\u2463"}, {"id": "ref-for-list-iterate\u2464"}, {"id": "ref-for-list-iterate\u2465"}, {"id": "ref-for-list-iterate\u2466"}, {"id": "ref-for-list-iterate\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2468"}, {"id": "ref-for-list-iterate\u2460\u24ea"}, {"id": "ref-for-list-iterate\u2460\u2460"}, {"id": "ref-for-list-iterate\u2460\u2461"}, {"id": "ref-for-list-iterate\u2460\u2462"}, {"id": "ref-for-list-iterate\u2460\u2463"}, {"id": "ref-for-list-iterate\u2460\u2464"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2465"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2466"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2467"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-iterate\u2460\u2468"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u24ea"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-list-iterate\u2461\u2460"}, {"id": "ref-for-list-iterate\u2461\u2461"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": true};
 window.dfnpanelData['45209803'] = {"dfnID": "45209803", "url": "https://infra.spec.whatwg.org/#map-iterate", "dfnText": "for each (for map)", "refSections": [{"refs": [{"id": "ref-for-map-iterate"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-iterate\u2460"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-map-iterate\u2461"}], "title": "6.3.1. Lookup Credential Source by Credential ID Algorithm"}, {"refs": [{"id": "ref-for-map-iterate\u2462"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-map-iterate\u2463"}, {"id": "ref-for-map-iterate\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-map-iterate\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": true};
 window.dfnpanelData['6b815fdd'] = {"dfnID": "6b815fdd", "url": "https://infra.spec.whatwg.org/#list-is-empty", "dfnText": "is empty", "refSections": [{"refs": [{"id": "ref-for-list-is-empty"}, {"id": "ref-for-list-is-empty\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-is-empty\u2461"}, {"id": "ref-for-list-is-empty\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2463"}, {"id": "ref-for-list-is-empty\u2464"}, {"id": "ref-for-list-is-empty\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2466"}, {"id": "ref-for-list-is-empty\u2467"}, {"id": "ref-for-list-is-empty\u2468"}, {"id": "ref-for-list-is-empty\u2460\u24ea"}, {"id": "ref-for-list-is-empty\u2460\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2461"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2462"}, {"id": "ref-for-list-is-empty\u2460\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": true};
 window.dfnpanelData['dd460c8e'] = {"dfnID": "dd460c8e", "url": "https://infra.spec.whatwg.org/#list-is-empty", "dfnText": "is not empty", "refSections": [{"refs": [{"id": "ref-for-list-is-empty"}, {"id": "ref-for-list-is-empty\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-is-empty\u2461"}, {"id": "ref-for-list-is-empty\u2462"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2463"}, {"id": "ref-for-list-is-empty\u2464"}, {"id": "ref-for-list-is-empty\u2465"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-is-empty\u2466"}, {"id": "ref-for-list-is-empty\u2467"}, {"id": "ref-for-list-is-empty\u2468"}, {"id": "ref-for-list-is-empty\u2460\u24ea"}, {"id": "ref-for-list-is-empty\u2460\u2460"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2461"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2462"}, {"id": "ref-for-list-is-empty\u2460\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list-is-empty\u2460\u2464"}], "title": "7.2. Verifying an Authentication Assertion"}], "external": true};
-window.dfnpanelData['5afbefcd'] = {"dfnID": "5afbefcd", "url": "https://infra.spec.whatwg.org/#list-item", "dfnText": "item (for list)", "refSections": [{"refs": [{"id": "ref-for-list-item"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-item\u2460"}, {"id": "ref-for-list-item\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2462"}, {"id": "ref-for-list-item\u2463"}, {"id": "ref-for-list-item\u2464"}, {"id": "ref-for-list-item\u2465"}, {"id": "ref-for-list-item\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-item\u2468"}, {"id": "ref-for-list-item\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2461"}], "title": "7.1. Registering a New Credential"}], "external": true};
+window.dfnpanelData['5afbefcd'] = {"dfnID": "5afbefcd", "url": "https://infra.spec.whatwg.org/#list-item", "dfnText": "item (for list)", "refSections": [{"refs": [{"id": "ref-for-list-item"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-list-item\u2460"}, {"id": "ref-for-list-item\u2461"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2462"}, {"id": "ref-for-list-item\u2463"}, {"id": "ref-for-list-item\u2464"}, {"id": "ref-for-list-item\u2465"}, {"id": "ref-for-list-item\u2466"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list-item\u2467"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-list-item\u2468"}, {"id": "ref-for-list-item\u2460\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-list-item\u2460\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-list-item\u2460\u2462"}], "title": "8.9. Compound Attestation Statement Format"}], "external": true};
 window.dfnpanelData['c88f3887'] = {"dfnID": "c88f3887", "url": "https://infra.spec.whatwg.org/#struct-item", "dfnText": "item (for struct)", "refSections": [{"refs": [{"id": "ref-for-struct-item"}, {"id": "ref-for-struct-item\u2460"}, {"id": "ref-for-struct-item\u2461"}, {"id": "ref-for-struct-item\u2462"}, {"id": "ref-for-struct-item\u2463"}, {"id": "ref-for-struct-item\u2464"}, {"id": "ref-for-struct-item\u2465"}, {"id": "ref-for-struct-item\u2466"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-struct-item\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct-item\u2468"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-struct-item\u2460\u24ea"}, {"id": "ref-for-struct-item\u2460\u2460"}], "title": "6.3.5. The silentCredentialDiscovery operation"}, {"refs": [{"id": "ref-for-struct-item\u2460\u2461"}, {"id": "ref-for-struct-item\u2460\u2462"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}], "external": true};
 window.dfnpanelData['d14a6f26'] = {"dfnID": "d14a6f26", "url": "https://infra.spec.whatwg.org/#map-key", "dfnText": "key", "refSections": [{"refs": [{"id": "ref-for-map-key"}, {"id": "ref-for-map-key\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}], "external": true};
 window.dfnpanelData['649608b9'] = {"dfnID": "649608b9", "url": "https://infra.spec.whatwg.org/#list", "dfnText": "list", "refSections": [{"refs": [{"id": "ref-for-list"}, {"id": "ref-for-list\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list\u2461"}, {"id": "ref-for-list\u2462"}], "title": "5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-list\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-list\u2464"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-list\u2465"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": true};
@@ -11205,7 +11241,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['rate-limiting'] = {"dfnID": "rate-limiting", "url": "#rate-limiting", "dfnText": "Rate Limiting", "refSections": [{"refs": [{"id": "ref-for-rate-limiting"}, {"id": "ref-for-rate-limiting\u2460"}], "title": "4. Terminology"}], "external": false};
 window.dfnpanelData['registration'] = {"dfnID": "registration", "url": "#registration", "dfnText": "Registration", "refSections": [{"refs": [{"id": "ref-for-registration"}, {"id": "ref-for-registration\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-registration\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-registration\u2462"}, {"id": "ref-for-registration\u2463"}, {"id": "ref-for-registration\u2464"}, {"id": "ref-for-registration\u2465"}, {"id": "ref-for-registration\u2466"}, {"id": "ref-for-registration\u2467"}, {"id": "ref-for-registration\u2468"}, {"id": "ref-for-registration\u2460\u24ea"}, {"id": "ref-for-registration\u2460\u2460"}, {"id": "ref-for-registration\u2460\u2461"}, {"id": "ref-for-registration\u2460\u2462"}, {"id": "ref-for-registration\u2460\u2463"}, {"id": "ref-for-registration\u2460\u2464"}, {"id": "ref-for-registration\u2460\u2465"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration\u2460\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-registration\u2460\u2467"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-registration\u2460\u2468"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration\u2461\u24ea"}, {"id": "ref-for-registration\u2461\u2460"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration\u2461\u2461"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-registration\u2461\u2462"}, {"id": "ref-for-registration\u2461\u2463"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-registration\u2461\u2464"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-registration\u2461\u2465"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-registration\u2461\u2466"}], "title": "15. Accessibility Considerations"}, {"refs": [{"id": "ref-for-registration\u2461\u2467"}], "title": "16. Acknowledgements"}], "external": false};
 window.dfnpanelData['registration-ceremony'] = {"dfnID": "registration-ceremony", "url": "#registration-ceremony", "dfnText": "Registration Ceremony", "refSections": [{"refs": [{"id": "ref-for-registration-ceremony"}, {"id": "ref-for-registration-ceremony\u2460"}, {"id": "ref-for-registration-ceremony\u2461"}, {"id": "ref-for-registration-ceremony\u2462"}, {"id": "ref-for-registration-ceremony\u2463"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-registration-ceremony\u2464"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-registration-ceremony\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2466"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2467"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-registration-ceremony\u2468"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u24ea"}, {"id": "ref-for-registration-ceremony\u2460\u2460"}, {"id": "ref-for-registration-ceremony\u2460\u2461"}, {"id": "ref-for-registration-ceremony\u2460\u2462"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2463"}, {"id": "ref-for-registration-ceremony\u2460\u2464"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2465"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-registration-ceremony\u2460\u2467"}, {"id": "ref-for-registration-ceremony\u2460\u2468"}, {"id": "ref-for-registration-ceremony\u2461\u24ea"}, {"id": "ref-for-registration-ceremony\u2461\u2460"}, {"id": "ref-for-registration-ceremony\u2461\u2461"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-registration-ceremony\u2461\u2462"}], "title": "15. Accessibility Considerations"}], "external": false};
-window.dfnpanelData['relying-party'] = {"dfnID": "relying-party", "url": "#relying-party", "dfnText": "Relying Party", "refSections": [{"refs": [{"id": "ref-for-relying-party\u2460"}, {"id": "ref-for-relying-party\u2461"}, {"id": "ref-for-relying-party\u2462"}, {"id": "ref-for-relying-party\u2463"}, {"id": "ref-for-relying-party\u2464"}, {"id": "ref-for-relying-party\u2465"}, {"id": "ref-for-relying-party\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-relying-party\u2467"}, {"id": "ref-for-relying-party\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2468"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2468"}, {"id": "ref-for-relying-party\u2464\u24ea"}, {"id": "ref-for-relying-party\u2464\u2460"}, {"id": "ref-for-relying-party\u2464\u2461"}, {"id": "ref-for-relying-party\u2464\u2462"}, {"id": "ref-for-relying-party\u2464\u2463"}, {"id": "ref-for-relying-party\u2464\u2464"}, {"id": "ref-for-relying-party\u2464\u2465"}, {"id": "ref-for-relying-party\u2464\u2466"}, {"id": "ref-for-relying-party\u2464\u2467"}, {"id": "ref-for-relying-party\u2464\u2468"}, {"id": "ref-for-relying-party\u2465\u24ea"}, {"id": "ref-for-relying-party\u2465\u2460"}, {"id": "ref-for-relying-party\u2465\u2461"}, {"id": "ref-for-relying-party\u2465\u2462"}, {"id": "ref-for-relying-party\u2465\u2463"}, {"id": "ref-for-relying-party\u2465\u2464"}, {"id": "ref-for-relying-party\u2465\u2465"}, {"id": "ref-for-relying-party\u2465\u2466"}, {"id": "ref-for-relying-party\u2465\u2467"}, {"id": "ref-for-relying-party\u2465\u2468"}, {"id": "ref-for-relying-party\u2466\u24ea"}, {"id": "ref-for-relying-party\u2466\u2460"}, {"id": "ref-for-relying-party\u2466\u2461"}, {"id": "ref-for-relying-party\u2466\u2462"}, {"id": "ref-for-relying-party\u2466\u2463"}, {"id": "ref-for-relying-party\u2466\u2464"}, {"id": "ref-for-relying-party\u2466\u2465"}, {"id": "ref-for-relying-party\u2466\u2466"}, {"id": "ref-for-relying-party\u2466\u2467"}, {"id": "ref-for-relying-party\u2466\u2468"}, {"id": "ref-for-relying-party\u2467\u24ea"}, {"id": "ref-for-relying-party\u2467\u2460"}, {"id": "ref-for-relying-party\u2467\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party\u2467\u2462"}, {"id": "ref-for-relying-party\u2467\u2463"}, {"id": "ref-for-relying-party\u2467\u2464"}, {"id": "ref-for-relying-party\u2467\u2465"}, {"id": "ref-for-relying-party\u2467\u2466"}, {"id": "ref-for-relying-party\u2467\u2467"}, {"id": "ref-for-relying-party\u2467\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party\u2468\u24ea"}, {"id": "ref-for-relying-party\u2468\u2460"}, {"id": "ref-for-relying-party\u2468\u2461"}, {"id": "ref-for-relying-party\u2468\u2462"}, {"id": "ref-for-relying-party\u2468\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2464"}, {"id": "ref-for-relying-party\u2468\u2465"}, {"id": "ref-for-relying-party\u2468\u2466"}, {"id": "ref-for-relying-party\u2468\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2460\u24ea\u2460"}, {"id": "ref-for-relying-party\u2460\u24ea\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2462"}, {"id": "ref-for-relying-party\u2460\u24ea\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2466"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2467"}, {"id": "ref-for-relying-party\u2460\u24ea\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2460\u2464"}, {"id": "ref-for-relying-party\u2460\u2460\u2465"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2466"}, {"id": "ref-for-relying-party\u2460\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2460\u2468"}, {"id": "ref-for-relying-party\u2460\u2461\u24ea"}, {"id": "ref-for-relying-party\u2460\u2461\u2460"}, {"id": "ref-for-relying-party\u2460\u2461\u2461"}, {"id": "ref-for-relying-party\u2460\u2461\u2462"}, {"id": "ref-for-relying-party\u2460\u2461\u2463"}, {"id": "ref-for-relying-party\u2460\u2461\u2464"}, {"id": "ref-for-relying-party\u2460\u2461\u2465"}, {"id": "ref-for-relying-party\u2460\u2461\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2461\u2467"}, {"id": "ref-for-relying-party\u2460\u2461\u2468"}, {"id": "ref-for-relying-party\u2460\u2462\u24ea"}, {"id": "ref-for-relying-party\u2460\u2462\u2460"}, {"id": "ref-for-relying-party\u2460\u2462\u2461"}, {"id": "ref-for-relying-party\u2460\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2463"}, {"id": "ref-for-relying-party\u2460\u2462\u2464"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2465"}, {"id": "ref-for-relying-party\u2460\u2462\u2466"}, {"id": "ref-for-relying-party\u2460\u2462\u2467"}, {"id": "ref-for-relying-party\u2460\u2462\u2468"}, {"id": "ref-for-relying-party\u2460\u2463\u24ea"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2460"}, {"id": "ref-for-relying-party\u2460\u2463\u2461"}, {"id": "ref-for-relying-party\u2460\u2463\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2463"}, {"id": "ref-for-relying-party\u2460\u2463\u2464"}, {"id": "ref-for-relying-party\u2460\u2463\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2466"}, {"id": "ref-for-relying-party\u2460\u2463\u2467"}, {"id": "ref-for-relying-party\u2460\u2463\u2468"}, {"id": "ref-for-relying-party\u2460\u2464\u24ea"}, {"id": "ref-for-relying-party\u2460\u2464\u2460"}, {"id": "ref-for-relying-party\u2460\u2464\u2461"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2462"}, {"id": "ref-for-relying-party\u2460\u2464\u2463"}, {"id": "ref-for-relying-party\u2460\u2464\u2464"}, {"id": "ref-for-relying-party\u2460\u2464\u2465"}, {"id": "ref-for-relying-party\u2460\u2464\u2466"}, {"id": "ref-for-relying-party\u2460\u2464\u2467"}, {"id": "ref-for-relying-party\u2460\u2464\u2468"}, {"id": "ref-for-relying-party\u2460\u2465\u24ea"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465\u2460"}, {"id": "ref-for-relying-party\u2460\u2465\u2461"}, {"id": "ref-for-relying-party\u2460\u2465\u2462"}, {"id": "ref-for-relying-party\u2460\u2465\u2463"}, {"id": "ref-for-relying-party\u2460\u2465\u2464"}, {"id": "ref-for-relying-party\u2460\u2465\u2465"}, {"id": "ref-for-relying-party\u2460\u2465\u2466"}, {"id": "ref-for-relying-party\u2460\u2465\u2467"}, {"id": "ref-for-relying-party\u2460\u2465\u2468"}, {"id": "ref-for-relying-party\u2460\u2466\u24ea"}, {"id": "ref-for-relying-party\u2460\u2466\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2461"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2462"}, {"id": "ref-for-relying-party\u2460\u2466\u2463"}, {"id": "ref-for-relying-party\u2460\u2466\u2464"}, {"id": "ref-for-relying-party\u2460\u2466\u2465"}, {"id": "ref-for-relying-party\u2460\u2466\u2466"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2467"}, {"id": "ref-for-relying-party\u2460\u2466\u2468"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u24ea"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2460"}, {"id": "ref-for-relying-party\u2460\u2467\u2461"}, {"id": "ref-for-relying-party\u2460\u2467\u2462"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2463"}, {"id": "ref-for-relying-party\u2460\u2467\u2464"}, {"id": "ref-for-relying-party\u2460\u2467\u2465"}, {"id": "ref-for-relying-party\u2460\u2467\u2466"}, {"id": "ref-for-relying-party\u2460\u2467\u2467"}, {"id": "ref-for-relying-party\u2460\u2467\u2468"}, {"id": "ref-for-relying-party\u2460\u2468\u24ea"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2460"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2461"}, {"id": "ref-for-relying-party\u2460\u2468\u2462"}, {"id": "ref-for-relying-party\u2460\u2468\u2463"}, {"id": "ref-for-relying-party\u2460\u2468\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2465"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2466"}, {"id": "ref-for-relying-party\u2460\u2468\u2467"}, {"id": "ref-for-relying-party\u2460\u2468\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2461\u24ea\u2460"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2461"}, {"id": "ref-for-relying-party\u2461\u24ea\u2462"}, {"id": "ref-for-relying-party\u2461\u24ea\u2463"}, {"id": "ref-for-relying-party\u2461\u24ea\u2464"}, {"id": "ref-for-relying-party\u2461\u24ea\u2465"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2466"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2467"}, {"id": "ref-for-relying-party\u2461\u24ea\u2468"}, {"id": "ref-for-relying-party\u2461\u2460\u24ea"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2460"}, {"id": "ref-for-relying-party\u2461\u2460\u2461"}, {"id": "ref-for-relying-party\u2461\u2460\u2462"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2463"}, {"id": "ref-for-relying-party\u2461\u2460\u2464"}, {"id": "ref-for-relying-party\u2461\u2460\u2465"}, {"id": "ref-for-relying-party\u2461\u2460\u2466"}, {"id": "ref-for-relying-party\u2461\u2460\u2467"}, {"id": "ref-for-relying-party\u2461\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u2461\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2460"}, {"id": "ref-for-relying-party\u2461\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2461\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2464"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2461\u2466"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2461\u2468"}, {"id": "ref-for-relying-party\u2461\u2462\u24ea"}, {"id": "ref-for-relying-party\u2461\u2462\u2460"}, {"id": "ref-for-relying-party\u2461\u2462\u2461"}, {"id": "ref-for-relying-party\u2461\u2462\u2462"}, {"id": "ref-for-relying-party\u2461\u2462\u2463"}, {"id": "ref-for-relying-party\u2461\u2462\u2464"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2465"}, {"id": "ref-for-relying-party\u2461\u2462\u2466"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2467"}, {"id": "ref-for-relying-party\u2461\u2462\u2468"}, {"id": "ref-for-relying-party\u2461\u2463\u24ea"}, {"id": "ref-for-relying-party\u2461\u2463\u2460"}, {"id": "ref-for-relying-party\u2461\u2463\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2462"}, {"id": "ref-for-relying-party\u2461\u2463\u2463"}, {"id": "ref-for-relying-party\u2461\u2463\u2464"}, {"id": "ref-for-relying-party\u2461\u2463\u2465"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2466"}, {"id": "ref-for-relying-party\u2461\u2463\u2467"}, {"id": "ref-for-relying-party\u2461\u2463\u2468"}, {"id": "ref-for-relying-party\u2461\u2464\u24ea"}, {"id": "ref-for-relying-party\u2461\u2464\u2460"}, {"id": "ref-for-relying-party\u2461\u2464\u2461"}, {"id": "ref-for-relying-party\u2461\u2464\u2462"}, {"id": "ref-for-relying-party\u2461\u2464\u2463"}, {"id": "ref-for-relying-party\u2461\u2464\u2464"}, {"id": "ref-for-relying-party\u2461\u2464\u2465"}, {"id": "ref-for-relying-party\u2461\u2464\u2466"}, {"id": "ref-for-relying-party\u2461\u2464\u2467"}, {"id": "ref-for-relying-party\u2461\u2464\u2468"}, {"id": "ref-for-relying-party\u2461\u2465\u24ea"}, {"id": "ref-for-relying-party\u2461\u2465\u2460"}, {"id": "ref-for-relying-party\u2461\u2465\u2461"}, {"id": "ref-for-relying-party\u2461\u2465\u2462"}, {"id": "ref-for-relying-party\u2461\u2465\u2463"}, {"id": "ref-for-relying-party\u2461\u2465\u2464"}, {"id": "ref-for-relying-party\u2461\u2465\u2465"}, {"id": "ref-for-relying-party\u2461\u2465\u2466"}, {"id": "ref-for-relying-party\u2461\u2465\u2467"}, {"id": "ref-for-relying-party\u2461\u2465\u2468"}, {"id": "ref-for-relying-party\u2461\u2466\u24ea"}, {"id": "ref-for-relying-party\u2461\u2466\u2460"}, {"id": "ref-for-relying-party\u2461\u2466\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2466\u2462"}, {"id": "ref-for-relying-party\u2461\u2466\u2463"}, {"id": "ref-for-relying-party\u2461\u2466\u2464"}, {"id": "ref-for-relying-party\u2461\u2466\u2465"}, {"id": "ref-for-relying-party\u2461\u2466\u2466"}, {"id": "ref-for-relying-party\u2461\u2466\u2467"}, {"id": "ref-for-relying-party\u2461\u2466\u2468"}, {"id": "ref-for-relying-party\u2461\u2467\u24ea"}, {"id": "ref-for-relying-party\u2461\u2467\u2460"}, {"id": "ref-for-relying-party\u2461\u2467\u2461"}, {"id": "ref-for-relying-party\u2461\u2467\u2462"}, {"id": "ref-for-relying-party\u2461\u2467\u2463"}, {"id": "ref-for-relying-party\u2461\u2467\u2464"}, {"id": "ref-for-relying-party\u2461\u2467\u2465"}, {"id": "ref-for-relying-party\u2461\u2467\u2466"}, {"id": "ref-for-relying-party\u2461\u2467\u2467"}, {"id": "ref-for-relying-party\u2461\u2467\u2468"}, {"id": "ref-for-relying-party\u2461\u2468\u24ea"}, {"id": "ref-for-relying-party\u2461\u2468\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2461"}, {"id": "ref-for-relying-party\u2461\u2468\u2462"}, {"id": "ref-for-relying-party\u2461\u2468\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2465"}, {"id": "ref-for-relying-party\u2461\u2468\u2466"}, {"id": "ref-for-relying-party\u2461\u2468\u2467"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2468"}, {"id": "ref-for-relying-party\u2462\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2462\u24ea\u2460"}, {"id": "ref-for-relying-party\u2462\u24ea\u2461"}, {"id": "ref-for-relying-party\u2462\u24ea\u2462"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2463"}, {"id": "ref-for-relying-party\u2462\u24ea\u2464"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2465"}, {"id": "ref-for-relying-party\u2462\u24ea\u2466"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2467"}, {"id": "ref-for-relying-party\u2462\u24ea\u2468"}, {"id": "ref-for-relying-party\u2462\u2460\u24ea"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2460"}, {"id": "ref-for-relying-party\u2462\u2460\u2461"}, {"id": "ref-for-relying-party\u2462\u2460\u2462"}, {"id": "ref-for-relying-party\u2462\u2460\u2463"}, {"id": "ref-for-relying-party\u2462\u2460\u2464"}, {"id": "ref-for-relying-party\u2462\u2460\u2465"}, {"id": "ref-for-relying-party\u2462\u2460\u2466"}, {"id": "ref-for-relying-party\u2462\u2460\u2467"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2468"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u24ea"}, {"id": "ref-for-relying-party\u2462\u2461\u2460"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2461"}, {"id": "ref-for-relying-party\u2462\u2461\u2462"}, {"id": "ref-for-relying-party\u2462\u2461\u2463"}, {"id": "ref-for-relying-party\u2462\u2461\u2464"}, {"id": "ref-for-relying-party\u2462\u2461\u2465"}, {"id": "ref-for-relying-party\u2462\u2461\u2466"}, {"id": "ref-for-relying-party\u2462\u2461\u2467"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2468"}, {"id": "ref-for-relying-party\u2462\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2462\u2460"}, {"id": "ref-for-relying-party\u2462\u2462\u2461"}, {"id": "ref-for-relying-party\u2462\u2462\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2463"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2464"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2462\u2468"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u24ea"}, {"id": "ref-for-relying-party\u2462\u2463\u2460"}, {"id": "ref-for-relying-party\u2462\u2463\u2461"}, {"id": "ref-for-relying-party\u2462\u2463\u2462"}, {"id": "ref-for-relying-party\u2462\u2463\u2463"}, {"id": "ref-for-relying-party\u2462\u2463\u2464"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2465"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2466"}, {"id": "ref-for-relying-party\u2462\u2463\u2467"}, {"id": "ref-for-relying-party\u2462\u2463\u2468"}, {"id": "ref-for-relying-party\u2462\u2464\u24ea"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2460"}, {"id": "ref-for-relying-party\u2462\u2464\u2461"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2462"}, {"id": "ref-for-relying-party\u2462\u2464\u2463"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2464"}], "title": "13.4. Security considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2465"}, {"id": "ref-for-relying-party\u2462\u2464\u2466"}, {"id": "ref-for-relying-party\u2462\u2464\u2467"}, {"id": "ref-for-relying-party\u2462\u2464\u2468"}, {"id": "ref-for-relying-party\u2462\u2465\u24ea"}, {"id": "ref-for-relying-party\u2462\u2465\u2460"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2461"}, {"id": "ref-for-relying-party\u2462\u2465\u2462"}, {"id": "ref-for-relying-party\u2462\u2465\u2463"}, {"id": "ref-for-relying-party\u2462\u2465\u2464"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2465"}, {"id": "ref-for-relying-party\u2462\u2465\u2466"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2467"}, {"id": "ref-for-relying-party\u2462\u2465\u2468"}, {"id": "ref-for-relying-party\u2462\u2466\u24ea"}, {"id": "ref-for-relying-party\u2462\u2466\u2460"}, {"id": "ref-for-relying-party\u2462\u2466\u2461"}, {"id": "ref-for-relying-party\u2462\u2466\u2462"}, {"id": "ref-for-relying-party\u2462\u2466\u2463"}, {"id": "ref-for-relying-party\u2462\u2466\u2464"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2465"}, {"id": "ref-for-relying-party\u2462\u2466\u2466"}, {"id": "ref-for-relying-party\u2462\u2466\u2467"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2468"}, {"id": "ref-for-relying-party\u2462\u2467\u24ea"}, {"id": "ref-for-relying-party\u2462\u2467\u2460"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2461"}, {"id": "ref-for-relying-party\u2462\u2467\u2462"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2463"}, {"id": "ref-for-relying-party\u2462\u2467\u2464"}, {"id": "ref-for-relying-party\u2462\u2467\u2465"}, {"id": "ref-for-relying-party\u2462\u2467\u2466"}, {"id": "ref-for-relying-party\u2462\u2467\u2467"}, {"id": "ref-for-relying-party\u2462\u2467\u2468"}, {"id": "ref-for-relying-party\u2462\u2468\u24ea"}, {"id": "ref-for-relying-party\u2462\u2468\u2460"}, {"id": "ref-for-relying-party\u2462\u2468\u2461"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2462"}, {"id": "ref-for-relying-party\u2462\u2468\u2463"}, {"id": "ref-for-relying-party\u2462\u2468\u2464"}, {"id": "ref-for-relying-party\u2462\u2468\u2465"}, {"id": "ref-for-relying-party\u2462\u2468\u2466"}, {"id": "ref-for-relying-party\u2462\u2468\u2467"}, {"id": "ref-for-relying-party\u2462\u2468\u2468"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u24ea"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2460"}, {"id": "ref-for-relying-party\u2463\u24ea\u2461"}, {"id": "ref-for-relying-party\u2463\u24ea\u2462"}, {"id": "ref-for-relying-party\u2463\u24ea\u2463"}, {"id": "ref-for-relying-party\u2463\u24ea\u2464"}, {"id": "ref-for-relying-party\u2463\u24ea\u2465"}, {"id": "ref-for-relying-party\u2463\u24ea\u2466"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2467"}, {"id": "ref-for-relying-party\u2463\u24ea\u2468"}, {"id": "ref-for-relying-party\u2463\u2460\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460\u2460"}, {"id": "ref-for-relying-party\u2463\u2460\u2461"}, {"id": "ref-for-relying-party\u2463\u2460\u2462"}, {"id": "ref-for-relying-party\u2463\u2460\u2463"}, {"id": "ref-for-relying-party\u2463\u2460\u2464"}, {"id": "ref-for-relying-party\u2463\u2460\u2465"}, {"id": "ref-for-relying-party\u2463\u2460\u2466"}, {"id": "ref-for-relying-party\u2463\u2460\u2467"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u2468"}, {"id": "ref-for-relying-party\u2463\u2461\u24ea"}, {"id": "ref-for-relying-party\u2463\u2461\u2460"}, {"id": "ref-for-relying-party\u2463\u2461\u2461"}, {"id": "ref-for-relying-party\u2463\u2461\u2462"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2463"}, {"id": "ref-for-relying-party\u2463\u2461\u2464"}, {"id": "ref-for-relying-party\u2463\u2461\u2465"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2466"}, {"id": "ref-for-relying-party\u2463\u2461\u2467"}, {"id": "ref-for-relying-party\u2463\u2461\u2468"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u24ea"}], "title": "14.6. Privacy considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2460"}, {"id": "ref-for-relying-party\u2463\u2462\u2461"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2462"}, {"id": "ref-for-relying-party\u2463\u2462\u2463"}, {"id": "ref-for-relying-party\u2463\u2462\u2464"}, {"id": "ref-for-relying-party\u2463\u2462\u2465"}, {"id": "ref-for-relying-party\u2463\u2462\u2466"}, {"id": "ref-for-relying-party\u2463\u2462\u2467"}, {"id": "ref-for-relying-party\u2463\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463\u2463"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2463\u2468"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2464\u24ea"}, {"id": "ref-for-relying-party\u2463\u2464\u2460"}], "title": "15. Accessibility Considerations"}], "external": false};
+window.dfnpanelData['relying-party'] = {"dfnID": "relying-party", "url": "#relying-party", "dfnText": "Relying Party", "refSections": [{"refs": [{"id": "ref-for-relying-party\u2460"}, {"id": "ref-for-relying-party\u2461"}, {"id": "ref-for-relying-party\u2462"}, {"id": "ref-for-relying-party\u2463"}, {"id": "ref-for-relying-party\u2464"}, {"id": "ref-for-relying-party\u2465"}, {"id": "ref-for-relying-party\u2466"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-relying-party\u2467"}, {"id": "ref-for-relying-party\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2464"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465"}], "title": "1.2.3. New Device Registration"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466"}], "title": "1.2.4. Other Use Cases and Configurations"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea"}, {"id": "ref-for-relying-party\u2461\u2460"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2464"}, {"id": "ref-for-relying-party\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2466"}, {"id": "ref-for-relying-party\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2468"}], "title": "1.3.3. Authentication"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460"}], "title": "1.3.5. Decommissioning"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461"}], "title": "2.1.1. Enumerations as DOMString types"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2464"}, {"id": "ref-for-relying-party\u2462\u2465"}, {"id": "ref-for-relying-party\u2462\u2466"}, {"id": "ref-for-relying-party\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2465"}, {"id": "ref-for-relying-party\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2468"}, {"id": "ref-for-relying-party\u2464\u24ea"}, {"id": "ref-for-relying-party\u2464\u2460"}, {"id": "ref-for-relying-party\u2464\u2461"}, {"id": "ref-for-relying-party\u2464\u2462"}, {"id": "ref-for-relying-party\u2464\u2463"}, {"id": "ref-for-relying-party\u2464\u2464"}, {"id": "ref-for-relying-party\u2464\u2465"}, {"id": "ref-for-relying-party\u2464\u2466"}, {"id": "ref-for-relying-party\u2464\u2467"}, {"id": "ref-for-relying-party\u2464\u2468"}, {"id": "ref-for-relying-party\u2465\u24ea"}, {"id": "ref-for-relying-party\u2465\u2460"}, {"id": "ref-for-relying-party\u2465\u2461"}, {"id": "ref-for-relying-party\u2465\u2462"}, {"id": "ref-for-relying-party\u2465\u2463"}, {"id": "ref-for-relying-party\u2465\u2464"}, {"id": "ref-for-relying-party\u2465\u2465"}, {"id": "ref-for-relying-party\u2465\u2466"}, {"id": "ref-for-relying-party\u2465\u2467"}, {"id": "ref-for-relying-party\u2465\u2468"}, {"id": "ref-for-relying-party\u2466\u24ea"}, {"id": "ref-for-relying-party\u2466\u2460"}, {"id": "ref-for-relying-party\u2466\u2461"}, {"id": "ref-for-relying-party\u2466\u2462"}, {"id": "ref-for-relying-party\u2466\u2463"}, {"id": "ref-for-relying-party\u2466\u2464"}, {"id": "ref-for-relying-party\u2466\u2465"}, {"id": "ref-for-relying-party\u2466\u2466"}, {"id": "ref-for-relying-party\u2466\u2467"}, {"id": "ref-for-relying-party\u2466\u2468"}, {"id": "ref-for-relying-party\u2467\u24ea"}, {"id": "ref-for-relying-party\u2467\u2460"}, {"id": "ref-for-relying-party\u2467\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party\u2467\u2462"}, {"id": "ref-for-relying-party\u2467\u2463"}, {"id": "ref-for-relying-party\u2467\u2464"}, {"id": "ref-for-relying-party\u2467\u2465"}, {"id": "ref-for-relying-party\u2467\u2466"}, {"id": "ref-for-relying-party\u2467\u2467"}, {"id": "ref-for-relying-party\u2467\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party\u2468\u24ea"}, {"id": "ref-for-relying-party\u2468\u2460"}, {"id": "ref-for-relying-party\u2468\u2461"}, {"id": "ref-for-relying-party\u2468\u2462"}, {"id": "ref-for-relying-party\u2468\u2463"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2464"}, {"id": "ref-for-relying-party\u2468\u2465"}, {"id": "ref-for-relying-party\u2468\u2466"}, {"id": "ref-for-relying-party\u2468\u2467"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-relying-party\u2468\u2468"}, {"id": "ref-for-relying-party\u2460\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2460\u24ea\u2460"}, {"id": "ref-for-relying-party\u2460\u24ea\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2462"}, {"id": "ref-for-relying-party\u2460\u24ea\u2463"}], "title": "5.1.4.2. Issuing a Credential Request to an Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2464"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2465"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2466"}], "title": "5.2. Authenticator Responses (interface AuthenticatorResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u24ea\u2467"}, {"id": "ref-for-relying-party\u2460\u24ea\u2468"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u24ea"}, {"id": "ref-for-relying-party\u2460\u2460\u2460"}, {"id": "ref-for-relying-party\u2460\u2460\u2461"}, {"id": "ref-for-relying-party\u2460\u2460\u2462"}, {"id": "ref-for-relying-party\u2460\u2460\u2463"}, {"id": "ref-for-relying-party\u2460\u2460\u2464"}, {"id": "ref-for-relying-party\u2460\u2460\u2465"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2460\u2466"}, {"id": "ref-for-relying-party\u2460\u2460\u2467"}, {"id": "ref-for-relying-party\u2460\u2460\u2468"}, {"id": "ref-for-relying-party\u2460\u2461\u24ea"}, {"id": "ref-for-relying-party\u2460\u2461\u2460"}, {"id": "ref-for-relying-party\u2460\u2461\u2461"}, {"id": "ref-for-relying-party\u2460\u2461\u2462"}, {"id": "ref-for-relying-party\u2460\u2461\u2463"}, {"id": "ref-for-relying-party\u2460\u2461\u2464"}, {"id": "ref-for-relying-party\u2460\u2461\u2465"}, {"id": "ref-for-relying-party\u2460\u2461\u2466"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2461\u2467"}, {"id": "ref-for-relying-party\u2460\u2461\u2468"}, {"id": "ref-for-relying-party\u2460\u2462\u24ea"}, {"id": "ref-for-relying-party\u2460\u2462\u2460"}, {"id": "ref-for-relying-party\u2460\u2462\u2461"}, {"id": "ref-for-relying-party\u2460\u2462\u2462"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2463"}, {"id": "ref-for-relying-party\u2460\u2462\u2464"}], "title": "5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2462\u2465"}, {"id": "ref-for-relying-party\u2460\u2462\u2466"}, {"id": "ref-for-relying-party\u2460\u2462\u2467"}, {"id": "ref-for-relying-party\u2460\u2462\u2468"}, {"id": "ref-for-relying-party\u2460\u2463\u24ea"}], "title": "5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2460"}, {"id": "ref-for-relying-party\u2460\u2463\u2461"}, {"id": "ref-for-relying-party\u2460\u2463\u2462"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2463"}, {"id": "ref-for-relying-party\u2460\u2463\u2464"}, {"id": "ref-for-relying-party\u2460\u2463\u2465"}], "title": "5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2463\u2466"}, {"id": "ref-for-relying-party\u2460\u2463\u2467"}, {"id": "ref-for-relying-party\u2460\u2463\u2468"}, {"id": "ref-for-relying-party\u2460\u2464\u24ea"}, {"id": "ref-for-relying-party\u2460\u2464\u2460"}, {"id": "ref-for-relying-party\u2460\u2464\u2461"}], "title": "5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2464\u2462"}, {"id": "ref-for-relying-party\u2460\u2464\u2463"}, {"id": "ref-for-relying-party\u2460\u2464\u2464"}, {"id": "ref-for-relying-party\u2460\u2464\u2465"}, {"id": "ref-for-relying-party\u2460\u2464\u2466"}, {"id": "ref-for-relying-party\u2460\u2464\u2467"}, {"id": "ref-for-relying-party\u2460\u2464\u2468"}, {"id": "ref-for-relying-party\u2460\u2465\u24ea"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2465\u2460"}, {"id": "ref-for-relying-party\u2460\u2465\u2461"}, {"id": "ref-for-relying-party\u2460\u2465\u2462"}, {"id": "ref-for-relying-party\u2460\u2465\u2463"}, {"id": "ref-for-relying-party\u2460\u2465\u2464"}, {"id": "ref-for-relying-party\u2460\u2465\u2465"}, {"id": "ref-for-relying-party\u2460\u2465\u2466"}, {"id": "ref-for-relying-party\u2460\u2465\u2467"}, {"id": "ref-for-relying-party\u2460\u2465\u2468"}, {"id": "ref-for-relying-party\u2460\u2466\u24ea"}, {"id": "ref-for-relying-party\u2460\u2466\u2460"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2461"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2462"}, {"id": "ref-for-relying-party\u2460\u2466\u2463"}, {"id": "ref-for-relying-party\u2460\u2466\u2464"}, {"id": "ref-for-relying-party\u2460\u2466\u2465"}, {"id": "ref-for-relying-party\u2460\u2466\u2466"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2466\u2467"}, {"id": "ref-for-relying-party\u2460\u2466\u2468"}], "title": "5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u24ea"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2460"}, {"id": "ref-for-relying-party\u2460\u2467\u2461"}, {"id": "ref-for-relying-party\u2460\u2467\u2462"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2467\u2463"}, {"id": "ref-for-relying-party\u2460\u2467\u2464"}, {"id": "ref-for-relying-party\u2460\u2467\u2465"}, {"id": "ref-for-relying-party\u2460\u2467\u2466"}, {"id": "ref-for-relying-party\u2460\u2467\u2467"}, {"id": "ref-for-relying-party\u2460\u2467\u2468"}, {"id": "ref-for-relying-party\u2460\u2468\u24ea"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2460"}], "title": "5.10. Using Web Authentication within iframe elements"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2461"}, {"id": "ref-for-relying-party\u2460\u2468\u2462"}, {"id": "ref-for-relying-party\u2460\u2468\u2463"}, {"id": "ref-for-relying-party\u2460\u2468\u2464"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2465"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-relying-party\u2460\u2468\u2466"}, {"id": "ref-for-relying-party\u2460\u2468\u2467"}, {"id": "ref-for-relying-party\u2460\u2468\u2468"}, {"id": "ref-for-relying-party\u2461\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2461\u24ea\u2460"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2461"}, {"id": "ref-for-relying-party\u2461\u24ea\u2462"}, {"id": "ref-for-relying-party\u2461\u24ea\u2463"}, {"id": "ref-for-relying-party\u2461\u24ea\u2464"}, {"id": "ref-for-relying-party\u2461\u24ea\u2465"}], "title": "6.1.3. Credential Backup State"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2466"}], "title": "6.2. Authenticator Taxonomy"}, {"refs": [{"id": "ref-for-relying-party\u2461\u24ea\u2467"}, {"id": "ref-for-relying-party\u2461\u24ea\u2468"}, {"id": "ref-for-relying-party\u2461\u2460\u24ea"}], "title": "6.2.2. Credential Storage Modality"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2460"}, {"id": "ref-for-relying-party\u2461\u2460\u2461"}, {"id": "ref-for-relying-party\u2461\u2460\u2462"}], "title": "6.2.3. Authentication Factor Capability"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2460\u2463"}, {"id": "ref-for-relying-party\u2461\u2460\u2464"}, {"id": "ref-for-relying-party\u2461\u2460\u2465"}, {"id": "ref-for-relying-party\u2461\u2460\u2466"}, {"id": "ref-for-relying-party\u2461\u2460\u2467"}, {"id": "ref-for-relying-party\u2461\u2460\u2468"}, {"id": "ref-for-relying-party\u2461\u2461\u24ea"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2460"}, {"id": "ref-for-relying-party\u2461\u2461\u2461"}, {"id": "ref-for-relying-party\u2461\u2461\u2462"}, {"id": "ref-for-relying-party\u2461\u2461\u2463"}], "title": "6.3.3. The authenticatorGetAssertion Operation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2464"}], "title": "6.4. String Handling"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2465"}, {"id": "ref-for-relying-party\u2461\u2461\u2466"}], "title": "6.4.1. String Truncation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2461\u2467"}, {"id": "ref-for-relying-party\u2461\u2461\u2468"}, {"id": "ref-for-relying-party\u2461\u2462\u24ea"}, {"id": "ref-for-relying-party\u2461\u2462\u2460"}, {"id": "ref-for-relying-party\u2461\u2462\u2461"}, {"id": "ref-for-relying-party\u2461\u2462\u2462"}, {"id": "ref-for-relying-party\u2461\u2462\u2463"}, {"id": "ref-for-relying-party\u2461\u2462\u2464"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2465"}, {"id": "ref-for-relying-party\u2461\u2462\u2466"}], "title": "6.5.1. Attestation in assertions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2462\u2467"}, {"id": "ref-for-relying-party\u2461\u2462\u2468"}, {"id": "ref-for-relying-party\u2461\u2463\u24ea"}, {"id": "ref-for-relying-party\u2461\u2463\u2460"}, {"id": "ref-for-relying-party\u2461\u2463\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2462"}, {"id": "ref-for-relying-party\u2461\u2463\u2463"}, {"id": "ref-for-relying-party\u2461\u2463\u2464"}, {"id": "ref-for-relying-party\u2461\u2463\u2465"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2463\u2466"}, {"id": "ref-for-relying-party\u2461\u2463\u2467"}, {"id": "ref-for-relying-party\u2461\u2463\u2468"}, {"id": "ref-for-relying-party\u2461\u2464\u24ea"}, {"id": "ref-for-relying-party\u2461\u2464\u2460"}, {"id": "ref-for-relying-party\u2461\u2464\u2461"}, {"id": "ref-for-relying-party\u2461\u2464\u2462"}, {"id": "ref-for-relying-party\u2461\u2464\u2463"}, {"id": "ref-for-relying-party\u2461\u2464\u2464"}, {"id": "ref-for-relying-party\u2461\u2464\u2465"}, {"id": "ref-for-relying-party\u2461\u2464\u2466"}, {"id": "ref-for-relying-party\u2461\u2464\u2467"}, {"id": "ref-for-relying-party\u2461\u2464\u2468"}, {"id": "ref-for-relying-party\u2461\u2465\u24ea"}, {"id": "ref-for-relying-party\u2461\u2465\u2460"}, {"id": "ref-for-relying-party\u2461\u2465\u2461"}, {"id": "ref-for-relying-party\u2461\u2465\u2462"}, {"id": "ref-for-relying-party\u2461\u2465\u2463"}, {"id": "ref-for-relying-party\u2461\u2465\u2464"}, {"id": "ref-for-relying-party\u2461\u2465\u2465"}, {"id": "ref-for-relying-party\u2461\u2465\u2466"}, {"id": "ref-for-relying-party\u2461\u2465\u2467"}, {"id": "ref-for-relying-party\u2461\u2465\u2468"}, {"id": "ref-for-relying-party\u2461\u2466\u24ea"}, {"id": "ref-for-relying-party\u2461\u2466\u2460"}, {"id": "ref-for-relying-party\u2461\u2466\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2466\u2462"}, {"id": "ref-for-relying-party\u2461\u2466\u2463"}, {"id": "ref-for-relying-party\u2461\u2466\u2464"}, {"id": "ref-for-relying-party\u2461\u2466\u2465"}, {"id": "ref-for-relying-party\u2461\u2466\u2466"}, {"id": "ref-for-relying-party\u2461\u2466\u2467"}, {"id": "ref-for-relying-party\u2461\u2466\u2468"}, {"id": "ref-for-relying-party\u2461\u2467\u24ea"}, {"id": "ref-for-relying-party\u2461\u2467\u2460"}, {"id": "ref-for-relying-party\u2461\u2467\u2461"}, {"id": "ref-for-relying-party\u2461\u2467\u2462"}, {"id": "ref-for-relying-party\u2461\u2467\u2463"}, {"id": "ref-for-relying-party\u2461\u2467\u2464"}, {"id": "ref-for-relying-party\u2461\u2467\u2465"}, {"id": "ref-for-relying-party\u2461\u2467\u2466"}, {"id": "ref-for-relying-party\u2461\u2467\u2467"}, {"id": "ref-for-relying-party\u2461\u2467\u2468"}, {"id": "ref-for-relying-party\u2461\u2468\u24ea"}, {"id": "ref-for-relying-party\u2461\u2468\u2460"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2461"}, {"id": "ref-for-relying-party\u2461\u2468\u2462"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2463"}, {"id": "ref-for-relying-party\u2461\u2468\u2464"}, {"id": "ref-for-relying-party\u2461\u2468\u2465"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2466"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-relying-party\u2461\u2468\u2467"}, {"id": "ref-for-relying-party\u2461\u2468\u2468"}, {"id": "ref-for-relying-party\u2462\u24ea\u24ea"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2460"}, {"id": "ref-for-relying-party\u2462\u24ea\u2461"}, {"id": "ref-for-relying-party\u2462\u24ea\u2462"}, {"id": "ref-for-relying-party\u2462\u24ea\u2463"}, {"id": "ref-for-relying-party\u2462\u24ea\u2464"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2465"}, {"id": "ref-for-relying-party\u2462\u24ea\u2466"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u24ea\u2467"}, {"id": "ref-for-relying-party\u2462\u24ea\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u24ea"}, {"id": "ref-for-relying-party\u2462\u2460\u2460"}, {"id": "ref-for-relying-party\u2462\u2460\u2461"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2460\u2462"}, {"id": "ref-for-relying-party\u2462\u2460\u2463"}, {"id": "ref-for-relying-party\u2462\u2460\u2464"}, {"id": "ref-for-relying-party\u2462\u2460\u2465"}, {"id": "ref-for-relying-party\u2462\u2460\u2466"}, {"id": "ref-for-relying-party\u2462\u2460\u2467"}, {"id": "ref-for-relying-party\u2462\u2460\u2468"}, {"id": "ref-for-relying-party\u2462\u2461\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2461"}, {"id": "ref-for-relying-party\u2462\u2461\u2462"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2461\u2463"}, {"id": "ref-for-relying-party\u2462\u2461\u2464"}, {"id": "ref-for-relying-party\u2462\u2461\u2465"}, {"id": "ref-for-relying-party\u2462\u2461\u2466"}, {"id": "ref-for-relying-party\u2462\u2461\u2467"}, {"id": "ref-for-relying-party\u2462\u2461\u2468"}, {"id": "ref-for-relying-party\u2462\u2462\u24ea"}], "title": "10.2.2.1. Relying Party Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2460"}, {"id": "ref-for-relying-party\u2462\u2462\u2461"}, {"id": "ref-for-relying-party\u2462\u2462\u2462"}, {"id": "ref-for-relying-party\u2462\u2462\u2463"}, {"id": "ref-for-relying-party\u2462\u2462\u2464"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2465"}], "title": "10.2.2.2.2. Attestation calculations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2466"}], "title": "10.2.2.3. devicePubKey Extension Output Verification Procedures"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2462\u2467"}, {"id": "ref-for-relying-party\u2462\u2462\u2468"}, {"id": "ref-for-relying-party\u2462\u2463\u24ea"}, {"id": "ref-for-relying-party\u2462\u2463\u2460"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2461"}, {"id": "ref-for-relying-party\u2462\u2463\u2462"}, {"id": "ref-for-relying-party\u2462\u2463\u2463"}, {"id": "ref-for-relying-party\u2462\u2463\u2464"}, {"id": "ref-for-relying-party\u2462\u2463\u2465"}, {"id": "ref-for-relying-party\u2462\u2463\u2466"}], "title": "10.2.2.3.2. Authentication (get())"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2467"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2463\u2468"}, {"id": "ref-for-relying-party\u2462\u2464\u24ea"}, {"id": "ref-for-relying-party\u2462\u2464\u2460"}, {"id": "ref-for-relying-party\u2462\u2464\u2461"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2462"}, {"id": "ref-for-relying-party\u2462\u2464\u2463"}], "title": "13.2. Physical Proximity between Client and Authenticator"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2464"}, {"id": "ref-for-relying-party\u2462\u2464\u2465"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2466"}], "title": "13.4. Security considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2464\u2467"}, {"id": "ref-for-relying-party\u2462\u2464\u2468"}, {"id": "ref-for-relying-party\u2462\u2465\u24ea"}, {"id": "ref-for-relying-party\u2462\u2465\u2460"}, {"id": "ref-for-relying-party\u2462\u2465\u2461"}, {"id": "ref-for-relying-party\u2462\u2465\u2462"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2463"}, {"id": "ref-for-relying-party\u2462\u2465\u2464"}, {"id": "ref-for-relying-party\u2462\u2465\u2465"}, {"id": "ref-for-relying-party\u2462\u2465\u2466"}], "title": "13.4.2. Visibility Considerations for Embedded Usage"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2465\u2467"}, {"id": "ref-for-relying-party\u2462\u2465\u2468"}], "title": "13.4.3. Cryptographic Challenges"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u24ea"}, {"id": "ref-for-relying-party\u2462\u2466\u2460"}, {"id": "ref-for-relying-party\u2462\u2466\u2461"}, {"id": "ref-for-relying-party\u2462\u2466\u2462"}, {"id": "ref-for-relying-party\u2462\u2466\u2463"}, {"id": "ref-for-relying-party\u2462\u2466\u2464"}, {"id": "ref-for-relying-party\u2462\u2466\u2465"}, {"id": "ref-for-relying-party\u2462\u2466\u2466"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2466\u2467"}, {"id": "ref-for-relying-party\u2462\u2466\u2468"}, {"id": "ref-for-relying-party\u2462\u2467\u24ea"}], "title": "13.4.5. Revoked Attestation Certificates"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2460"}, {"id": "ref-for-relying-party\u2462\u2467\u2461"}, {"id": "ref-for-relying-party\u2462\u2467\u2462"}], "title": "13.4.6. Credential Loss and Key Mobility"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2463"}, {"id": "ref-for-relying-party\u2462\u2467\u2464"}], "title": "13.4.7. Unprotected account detection"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2467\u2465"}, {"id": "ref-for-relying-party\u2462\u2467\u2466"}, {"id": "ref-for-relying-party\u2462\u2467\u2467"}, {"id": "ref-for-relying-party\u2462\u2467\u2468"}, {"id": "ref-for-relying-party\u2462\u2468\u24ea"}, {"id": "ref-for-relying-party\u2462\u2468\u2460"}, {"id": "ref-for-relying-party\u2462\u2468\u2461"}, {"id": "ref-for-relying-party\u2462\u2468\u2462"}, {"id": "ref-for-relying-party\u2462\u2468\u2463"}], "title": "13.4.8. Code injection attacks"}, {"refs": [{"id": "ref-for-relying-party\u2462\u2468\u2464"}, {"id": "ref-for-relying-party\u2462\u2468\u2465"}, {"id": "ref-for-relying-party\u2462\u2468\u2466"}, {"id": "ref-for-relying-party\u2462\u2468\u2467"}, {"id": "ref-for-relying-party\u2462\u2468\u2468"}, {"id": "ref-for-relying-party\u2463\u24ea\u24ea"}, {"id": "ref-for-relying-party\u2463\u24ea\u2460"}], "title": "13.4.9. Validating the origin of a credential"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2461"}], "title": "14. Privacy Considerations"}, {"refs": [{"id": "ref-for-relying-party\u2463\u24ea\u2462"}, {"id": "ref-for-relying-party\u2463\u24ea\u2463"}, {"id": "ref-for-relying-party\u2463\u24ea\u2464"}, {"id": "ref-for-relying-party\u2463\u24ea\u2465"}, {"id": "ref-for-relying-party\u2463\u24ea\u2466"}, {"id": "ref-for-relying-party\u2463\u24ea\u2467"}, {"id": "ref-for-relying-party\u2463\u24ea\u2468"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2460\u24ea"}, {"id": "ref-for-relying-party\u2463\u2460\u2460"}, {"id": "ref-for-relying-party\u2463\u2460\u2461"}, {"id": "ref-for-relying-party\u2463\u2460\u2462"}, {"id": "ref-for-relying-party\u2463\u2460\u2463"}, {"id": "ref-for-relying-party\u2463\u2460\u2464"}, {"id": "ref-for-relying-party\u2463\u2460\u2465"}, {"id": "ref-for-relying-party\u2463\u2460\u2466"}, {"id": "ref-for-relying-party\u2463\u2460\u2467"}, {"id": "ref-for-relying-party\u2463\u2460\u2468"}, {"id": "ref-for-relying-party\u2463\u2461\u24ea"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2460"}, {"id": "ref-for-relying-party\u2463\u2461\u2461"}, {"id": "ref-for-relying-party\u2463\u2461\u2462"}, {"id": "ref-for-relying-party\u2463\u2461\u2463"}, {"id": "ref-for-relying-party\u2463\u2461\u2464"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2465"}, {"id": "ref-for-relying-party\u2463\u2461\u2466"}, {"id": "ref-for-relying-party\u2463\u2461\u2467"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2461\u2468"}, {"id": "ref-for-relying-party\u2463\u2462\u24ea"}, {"id": "ref-for-relying-party\u2463\u2462\u2460"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2461"}], "title": "14.6. Privacy considerations for Relying Parties"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2462"}, {"id": "ref-for-relying-party\u2463\u2462\u2463"}], "title": "14.6.1. User Handle Contents"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2462\u2464"}, {"id": "ref-for-relying-party\u2463\u2462\u2465"}, {"id": "ref-for-relying-party\u2463\u2462\u2466"}, {"id": "ref-for-relying-party\u2463\u2462\u2467"}, {"id": "ref-for-relying-party\u2463\u2462\u2468"}, {"id": "ref-for-relying-party\u2463\u2463\u24ea"}, {"id": "ref-for-relying-party\u2463\u2463\u2460"}, {"id": "ref-for-relying-party\u2463\u2463\u2461"}, {"id": "ref-for-relying-party\u2463\u2463\u2462"}, {"id": "ref-for-relying-party\u2463\u2463\u2463"}, {"id": "ref-for-relying-party\u2463\u2463\u2464"}, {"id": "ref-for-relying-party\u2463\u2463\u2465"}], "title": "14.6.2. Username Enumeration"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2463\u2466"}, {"id": "ref-for-relying-party\u2463\u2463\u2467"}, {"id": "ref-for-relying-party\u2463\u2463\u2468"}, {"id": "ref-for-relying-party\u2463\u2464\u24ea"}, {"id": "ref-for-relying-party\u2463\u2464\u2460"}], "title": "14.6.3. Privacy leak via credential IDs"}, {"refs": [{"id": "ref-for-relying-party\u2463\u2464\u2461"}, {"id": "ref-for-relying-party\u2463\u2464\u2462"}], "title": "15. Accessibility Considerations"}], "external": false};
 window.dfnpanelData['webauthn-relying-party'] = {"dfnID": "webauthn-relying-party", "url": "#webauthn-relying-party", "dfnText": "WebAuthn Relying Party", "refSections": [{"refs": [{"id": "ref-for-webauthn-relying-party\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462"}], "title": "1.3.1. Registration"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463"}], "title": "1.3.2. Registration Specifically with User-Verifying Platform Authenticator"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464"}], "title": "2.3. WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2465"}, {"id": "ref-for-webauthn-relying-party\u2466"}, {"id": "ref-for-webauthn-relying-party\u2467"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2468"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u24ea"}], "title": "5.1. PublicKeyCredential Interface"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2460"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2461"}], "title": "5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2462"}], "title": "5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2463"}], "title": "5.1.8. Availability of a passkey platform authenticator - PublicKeyCredential\u2019s isPasskeyPlatformAuthenticatorAvailable() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2464"}], "title": "5.1.9. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2465"}], "title": "5.1.10. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2466"}], "title": "5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2467"}], "title": "5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2460\u2468"}], "title": "5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u24ea"}], "title": "5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2460"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2461"}], "title": "5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2462"}], "title": "5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2463"}], "title": "5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2464"}], "title": "5.8.7. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2465"}], "title": "6. WebAuthn Authenticator Model"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2466"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2467"}], "title": "6.1.1. Signature Counter Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2461\u2468"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u24ea"}, {"id": "ref-for-webauthn-relying-party\u2462\u2460"}], "title": "7. WebAuthn Relying Party Operations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2461"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2462"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2463"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2464"}], "title": "9.2. Defining Extensions"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2465"}], "title": "9.3. Extending Request Parameters"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2466"}], "title": "10.1.1. FIDO AppID Extension (appid)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2462\u2468"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u24ea"}], "title": "12.2. WebAuthn Attestation Statement Format Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2460"}, {"id": "ref-for-webauthn-relying-party\u2463\u2461"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2462"}, {"id": "ref-for-webauthn-relying-party\u2463\u2463"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2464"}], "title": "13. Security Considerations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2465"}], "title": "13.1. Credential ID Unsigned"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2466"}], "title": "13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2467"}], "title": "13.4.1. Security Benefits for WebAuthn Relying Parties"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2463\u2468"}], "title": "13.4.4. Attestation Limitations"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u24ea"}], "title": "14.1. De-anonymization Prevention Measures"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2460"}], "title": "14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2461"}], "title": "14.3. Authenticator-local Biometric Recognition"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2462"}], "title": "14.5.1. Registration Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2463"}], "title": "14.5.2. Authentication Ceremony Privacy"}, {"refs": [{"id": "ref-for-webauthn-relying-party\u2464\u2464"}], "title": "14.6.2. Username Enumeration"}], "external": false};
 window.dfnpanelData['web-application'] = {"dfnID": "web-application", "url": "#web-application", "dfnText": "web application", "refSections": [{"refs": [{"id": "ref-for-web-application\u2460"}], "title": "1. Introduction"}, {"refs": [{"id": "ref-for-web-application\u2461"}, {"id": "ref-for-web-application\u2462"}], "title": "1.1. Specification Roadmap"}, {"refs": [{"id": "ref-for-web-application\u2463"}], "title": "11. User Agent Automation"}, {"refs": [{"id": "ref-for-web-application\u2464"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}, {"refs": [{"id": "ref-for-web-application\u2465"}], "title": "13. Security Considerations"}], "external": false};
 window.dfnpanelData['relying-party-identifier'] = {"dfnID": "relying-party-identifier", "url": "#relying-party-identifier", "dfnText": "Relying Party Identifier", "refSections": [{"refs": [{"id": "ref-for-relying-party-identifier"}, {"id": "ref-for-relying-party-identifier\u2460"}, {"id": "ref-for-relying-party-identifier\u2461"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-relying-party-identifier\u2462"}], "title": "5. Web Authentication API"}, {"refs": [{"id": "ref-for-relying-party-identifier\u2463"}], "title": "6.3.5. The silentCredentialDiscovery operation"}], "external": false};
@@ -11444,8 +11480,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['authdata-attestedcredentialdata-credentialpublickey'] = {"dfnID": "authdata-attestedcredentialdata-credentialpublickey", "url": "#authdata-attestedcredentialdata-credentialpublickey", "dfnText": "credentialPublicKey", "refSections": [{"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2461"}, {"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2462"}], "title": "6.1. Authenticator Data"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2463"}], "title": "6.5.2.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2465"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2466"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2467"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2468"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460\u24ea"}], "title": "10.2.2.2. Extension Definition"}], "external": false};
 window.dfnpanelData['signing-procedure'] = {"dfnID": "signing-procedure", "url": "#signing-procedure", "dfnText": "Signing procedure", "refSections": [{"refs": [{"id": "ref-for-signing-procedure"}], "title": "5.2.1.1. Easily accessing credential data"}, {"refs": [{"id": "ref-for-signing-procedure"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-signing-procedure\u2460"}], "title": "6.5.5. Generating an Attestation Object"}], "external": false};
 window.dfnpanelData['authenticator-data-for-the-attestation'] = {"dfnID": "authenticator-data-for-the-attestation", "url": "#authenticator-data-for-the-attestation", "dfnText": "authenticator data\nfor the attestation", "refSections": [{"refs": [{"id": "ref-for-authenticator-data-for-the-attestation"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2460"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2461"}, {"id": "ref-for-authenticator-data-for-the-attestation\u2462"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2463"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-authenticator-data-for-the-attestation\u2464"}], "title": "8.6. FIDO U2F Attestation Statement Format"}], "external": false};
-window.dfnpanelData['verification-procedure'] = {"dfnID": "verification-procedure", "url": "#verification-procedure", "dfnText": "Verification procedure", "refSections": [{"refs": [{"id": "ref-for-verification-procedure"}, {"id": "ref-for-verification-procedure\u2460"}, {"id": "ref-for-verification-procedure\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-verification-procedure\u2462"}, {"id": "ref-for-verification-procedure\u2463"}, {"id": "ref-for-verification-procedure\u2464"}, {"id": "ref-for-verification-procedure\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-verification-procedure\u2466"}, {"id": "ref-for-verification-procedure\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-verification-procedure\u2468"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u24ea"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2461"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2462"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2463"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2464"}, {"id": "ref-for-verification-procedure\u2460\u2465"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
-window.dfnpanelData['verification-procedure-inputs'] = {"dfnID": "verification-procedure-inputs", "url": "#verification-procedure-inputs", "dfnText": "verification procedure inputs", "refSections": [{"refs": [{"id": "ref-for-verification-procedure-inputs"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2460"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2461"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2462"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2463"}], "title": "8.6. FIDO U2F Attestation Statement Format"}], "external": false};
+window.dfnpanelData['verification-procedure'] = {"dfnID": "verification-procedure", "url": "#verification-procedure", "dfnText": "Verification procedure", "refSections": [{"refs": [{"id": "ref-for-verification-procedure"}, {"id": "ref-for-verification-procedure\u2460"}, {"id": "ref-for-verification-procedure\u2461"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-verification-procedure\u2462"}, {"id": "ref-for-verification-procedure\u2463"}, {"id": "ref-for-verification-procedure\u2464"}, {"id": "ref-for-verification-procedure\u2465"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-verification-procedure\u2466"}, {"id": "ref-for-verification-procedure\u2467"}], "title": "7.2. Verifying an Authentication Assertion"}, {"refs": [{"id": "ref-for-verification-procedure\u2468"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u24ea"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2461"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2462"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2463"}, {"id": "ref-for-verification-procedure\u2460\u2464"}, {"id": "ref-for-verification-procedure\u2460\u2465"}], "title": "8.9. Compound Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2466"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-verification-procedure\u2460\u2467"}, {"id": "ref-for-verification-procedure\u2460\u2468"}], "title": "10.2.2.3.2. Authentication (get())"}], "external": false};
+window.dfnpanelData['verification-procedure-inputs'] = {"dfnID": "verification-procedure-inputs", "url": "#verification-procedure-inputs", "dfnText": "verification procedure inputs", "refSections": [{"refs": [{"id": "ref-for-verification-procedure-inputs"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2460"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2461"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2462"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2463"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-verification-procedure-inputs\u2464"}, {"id": "ref-for-verification-procedure-inputs\u2465"}], "title": "8.9. Compound Attestation Statement Format"}], "external": false};
 window.dfnpanelData['authenticator-data-claimed-to-have-been-used-for-the-attestation'] = {"dfnID": "authenticator-data-claimed-to-have-been-used-for-the-attestation", "url": "#authenticator-data-claimed-to-have-been-used-for-the-attestation", "dfnText": "authenticator data claimed to have been used for the attestation", "refSections": [{"refs": [{"id": "ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation"}], "title": "8.4. Android Key Attestation Statement Format"}], "external": false};
 window.dfnpanelData['attestation-trust-path'] = {"dfnID": "attestation-trust-path", "url": "#attestation-trust-path", "dfnText": "attestation trust path", "refSections": [{"refs": [{"id": "ref-for-attestation-trust-path"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2460"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2461"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2462"}, {"id": "ref-for-attestation-trust-path\u2463"}], "title": "8.2. Packed Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2464"}], "title": "8.3. TPM Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2465"}], "title": "8.4. Android Key Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2466"}], "title": "8.5. Android SafetyNet Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2467"}], "title": "8.6. FIDO U2F Attestation Statement Format"}, {"refs": [{"id": "ref-for-attestation-trust-path\u2468"}], "title": "8.7. None Attestation Statement Format"}], "external": false};
 window.dfnpanelData['basic-attestation'] = {"dfnID": "basic-attestation", "url": "#basic-attestation", "dfnText": "Basic Attestation", "refSections": [{"refs": [{"id": "ref-for-basic-attestation"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-basic-attestation\u2460"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
@@ -11458,7 +11494,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 window.dfnpanelData['anonymization-ca'] = {"dfnID": "anonymization-ca", "url": "#anonymization-ca", "dfnText": "Anonymization CA", "refSections": [{"refs": [{"id": "ref-for-anonymization-ca"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-anonymization-ca\u2460"}, {"id": "ref-for-anonymization-ca\u2461"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-anonymization-ca\u2462"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-anonymization-ca\u2463"}, {"id": "ref-for-anonymization-ca\u2464"}], "title": "8.8. Apple Anonymous Attestation Statement Format"}, {"refs": [{"id": "ref-for-anonymization-ca\u2465"}, {"id": "ref-for-anonymization-ca\u2466"}, {"id": "ref-for-anonymization-ca\u2467"}, {"id": "ref-for-anonymization-ca\u2468"}], "title": "14.4.1. Attestation Privacy"}], "external": false};
 window.dfnpanelData['anonca'] = {"dfnID": "anonca", "url": "#anonca", "dfnText": "AnonCA", "refSections": [{"refs": [{"id": "ref-for-anonca"}], "title": "6.5.4. Attestation Types"}], "external": false};
 window.dfnpanelData['none'] = {"dfnID": "none", "url": "#none", "dfnText": "None", "refSections": [{"refs": [{"id": "ref-for-none"}], "title": "5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"}, {"refs": [{"id": "ref-for-none\u2460"}, {"id": "ref-for-none\u2461"}], "title": "6.5. Attestation"}, {"refs": [{"id": "ref-for-none\u2462"}], "title": "6.5.4. Attestation Types"}, {"refs": [{"id": "ref-for-none\u2463"}, {"id": "ref-for-none\u2464"}], "title": "7.1. Registering a New Credential"}, {"refs": [{"id": "ref-for-none\u2465"}, {"id": "ref-for-none\u2466"}], "title": "8.7. None Attestation Statement Format"}, {"refs": [{"id": "ref-for-none\u2467"}], "title": "10.2.2.3.1. Registration (create())"}, {"refs": [{"id": "ref-for-none\u2468"}], "title": "13.4.4. Attestation Limitations"}], "external": false};
-window.dfnpanelData['attestation-statement-format-identifier'] = {"dfnID": "attestation-statement-format-identifier", "url": "#attestation-statement-format-identifier", "dfnText": "attestation statement format identifier", "refSections": [{"refs": [{"id": "ref-for-attestation-statement-format-identifier"}, {"id": "ref-for-attestation-statement-format-identifier\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2462"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2463"}], "title": "8.1. Attestation Statement Format Identifiers"}], "external": false};
+window.dfnpanelData['attestation-statement-format-identifier'] = {"dfnID": "attestation-statement-format-identifier", "url": "#attestation-statement-format-identifier", "dfnText": "attestation statement format identifier", "refSections": [{"refs": [{"id": "ref-for-attestation-statement-format-identifier"}, {"id": "ref-for-attestation-statement-format-identifier\u2460"}], "title": "6.3.2. The authenticatorMakeCredential Operation"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2461"}], "title": "6.5.3. Attestation Statement Formats"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2462"}], "title": "6.5.5. Generating an Attestation Object"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2463"}], "title": "8.1. Attestation Statement Format Identifiers"}, {"refs": [{"id": "ref-for-attestation-statement-format-identifier\u2464"}], "title": "8.9. Compound Attestation Statement Format"}], "external": false};
 window.dfnpanelData['android-key-attestation-certificate-extension-data'] = {"dfnID": "android-key-attestation-certificate-extension-data", "url": "#android-key-attestation-certificate-extension-data", "dfnText": "android key attestation certificate extension\ndata", "refSections": [{"refs": [{"id": "ref-for-android-key-attestation-certificate-extension-data"}, {"id": "ref-for-android-key-attestation-certificate-extension-data\u2460"}], "title": "8.4. Android Key Attestation Statement Format"}], "external": false};
 window.dfnpanelData['webauthn-extensions'] = {"dfnID": "webauthn-extensions", "url": "#webauthn-extensions", "dfnText": "WebAuthn Extensions", "refSections": [{"refs": [{"id": "ref-for-webauthn-extensions"}, {"id": "ref-for-webauthn-extensions\u2460"}], "title": "4. Terminology"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2461"}], "title": "5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2462"}], "title": "5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2463"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2464"}], "title": "5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2465"}], "title": "5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2466"}], "title": "5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2467"}], "title": "5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)"}, {"refs": [{"id": "ref-for-webauthn-extensions\u2468"}, {"id": "ref-for-webauthn-extensions\u2460\u24ea"}, {"id": "ref-for-webauthn-extensions\u2460\u2460"}], "title": "9. WebAuthn Extensions"}], "external": false};
 window.dfnpanelData['registration-extension'] = {"dfnID": "registration-extension", "url": "#registration-extension", "dfnText": "registration\nextension", "refSections": [{"refs": [{"id": "ref-for-registration-extension"}], "title": "5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"}, {"refs": [{"id": "ref-for-registration-extension\u2460"}], "title": "5.7. WebAuthn Extensions Inputs and Outputs"}, {"refs": [{"id": "ref-for-registration-extension\u2461"}, {"id": "ref-for-registration-extension\u2462"}, {"id": "ref-for-registration-extension\u2463"}, {"id": "ref-for-registration-extension\u2464"}, {"id": "ref-for-registration-extension\u2465"}, {"id": "ref-for-registration-extension\u2466"}], "title": "9. WebAuthn Extensions"}, {"refs": [{"id": "ref-for-registration-extension\u2467"}], "title": "10.1.2. FIDO AppID Exclusion Extension (appidExclude)"}, {"refs": [{"id": "ref-for-registration-extension\u2468"}, {"id": "ref-for-registration-extension\u2460\u24ea"}], "title": "10.1.3. Credential Properties Extension (credProps)"}, {"refs": [{"id": "ref-for-registration-extension\u2460\u2460"}, {"id": "ref-for-registration-extension\u2460\u2461"}, {"id": "ref-for-registration-extension\u2460\u2462"}], "title": "10.1.4. Pseudo-random function extension (prf)"}, {"refs": [{"id": "ref-for-registration-extension\u2460\u2463"}, {"id": "ref-for-registration-extension\u2460\u2464"}, {"id": "ref-for-registration-extension\u2460\u2465"}, {"id": "ref-for-registration-extension\u2460\u2466"}, {"id": "ref-for-registration-extension\u2460\u2467"}, {"id": "ref-for-registration-extension\u2460\u2468"}, {"id": "ref-for-registration-extension\u2461\u24ea"}], "title": "10.1.5. Large blob storage extension (largeBlob)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2460"}], "title": "10.2.1. User Verification Method Extension (uvm)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2461"}], "title": "10.2.2. Device-bound public key extension (devicePubKey)"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2462"}], "title": "10.2.2.2. Extension Definition"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2463"}], "title": "12.3. WebAuthn Extension Identifier Registrations Updates"}, {"refs": [{"id": "ref-for-registration-extension\u2461\u2464"}, {"id": "ref-for-registration-extension\u2461\u2465"}], "title": "12.4. WebAuthn Extension Identifier Registrations"}], "external": false};