From 253ba77d62b78e8f7e6b7e0739cd1dfe125bb67c Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Tue, 29 Oct 2024 15:34:57 +0000
Subject: [PATCH] Merge pull request #2183 from w3c/issue-2178-prf-warning

SHA: 406ec42a3b8667405f4b9056efa49808c0f5aaac
Reason: push, by emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 31 ++++++++++++++++++-------------
 1 file changed, 18 insertions(+), 13 deletions(-)

diff --git a/index.html b/index.html
index 07346266c..e2aee4573 100644
--- a/index.html
+++ b/index.html
@@ -4,9 +4,9 @@
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <title>Web Authentication: An API for accessing Public Key Credentials - Level 3</title>
   <meta content="ED" name="w3c-status">
-  <meta content="Bikeshed version 44fb9b41e, updated Mon Oct 21 15:57:35 2024 -0700" name="generator">
+  <meta content="Bikeshed version 9e4e5f0f6, updated Mon Oct 28 14:51:59 2024 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="3c506d45dc133046028f8dec18eb8ab77d6e1fbd" name="revision">
+  <meta content="406ec42a3b8667405f4b9056efa49808c0f5aaac" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-10-28">28 October 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types/#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-10-29">29 October 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -7744,6 +7744,11 @@ <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-results"><code>results</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues⑤">AuthenticationExtensionsPRFValues</a></span>
        <dd data-md>
         <p>The results of evaluating the PRF for the inputs given in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑦">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑤">evalByCredential</a></code>. Outputs may not be available during <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>; see comments in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑧">eval</a></code>.</p>
+        <p><strong class="advisement"> For some use cases, for example if PRF outputs are used to derive encryption keys to use only on the client side,
+it may be necessary to omit this <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results③">results</a></code> output
+if the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③②">PublicKeyCredential</a></code> is sent to a remote server,
+for example to perform the procedures in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a>.
+Note in particular that the <code class="idl"><a data-link-type="idl" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson①">RegistrationResponseJSON</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson①">AuthenticationResponseJSON</a></code> returned by <code><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③③">PublicKeyCredential</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-tojson" id="ref-for-dom-publickeycredential-tojson①">toJSON()</a></code></code> will include this <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results④">results</a></code> output if present.</strong></p>
       </dl>
      </div>
    </dl>
@@ -7766,7 +7771,7 @@ <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors
 <c- p>{</c-> prf<c- o>:</c-> <c- p>{}</c-> <c- p>}</c->
 </pre>
     <li data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results③">results</a></code> output may be present
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑤">results</a></code> output may be present
 during <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremonies</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑨">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential⑥">evalByCredential</a></code> input is present:</p>
 <pre class="example highlight" id="example-70210d97"><a class="self-link" href="#example-70210d97"></a><c- c1>// Example extension inputs:</c->
 <c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> eval<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> <c- ow>new</c-> Uint8Array<c- p>([</c-><c- mf>1</c-><c- p>,</c-> <c- mf>2</c-><c- p>,</c-> <c- mf>3</c-><c- p>,</c-> <c- mf>4</c-><c- p>])</c-> <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
@@ -7781,8 +7786,8 @@ <h5 class="heading settled" data-level="10.1.4.1" id="prf-extension-test-vectors
 <c- p>{</c-> prf<c- o>:</c-> <c- p>{</c-> results<c- o>:</c-> <c- p>{</c-> first<c- o>:</c-> ArrayBuffer <c- p>}</c-> <c- p>}</c-> <c- p>}</c->
 </pre>
     <li data-md>
-     <p>The <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results④">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second④">second</a></code></code> output
-is present if and only if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑤">results</a></code> output is present
+     <p>The <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑥">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second④">second</a></code></code> output
+is present if and only if the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑦">results</a></code> output is present
 and the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑤">second</a></code></code> input was present in the chosen PRF inputs:</p>
 <pre class="example highlight" id="example-abd7c645"><a class="self-link" href="#example-abd7c645"></a><c- c1>// Example extension inputs:</c->
 <c- p>{</c->
@@ -7864,7 +7869,7 @@ <h5 class="heading settled" data-level="10.1.4.2" id="prf-extension-test-vectors
      <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑤">first</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second⑨">second</a></code> inputs
 are mapped in the examples as <code>prf_eval_first</code> and <code>prf_eval_second</code>, respectively.
 The <code>prf_results_first</code> and <code>prf_results_second</code> values in the examples
-are mapped to the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑥">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑥">first</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑦">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second①⓪">second</a></code></code> outputs, respectively.</p>
+are mapped to the <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑧">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first⑥">first</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results⑨">results</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second①⓪">second</a></code></code> outputs, respectively.</p>
     <li data-md>
      <p>Single input case using PIN protocol 2:</p>
 <pre class="example highlight" id="example-7688ee66"><a class="self-link" href="#example-7688ee66"></a><c- c1>; Inputs from Relying Party:</c->
@@ -8914,7 +8919,7 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
    <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
 confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④③">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
-   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③②">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
+   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③④">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④④">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
 same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Party</a> and passing through the same attacker.</p>
    <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
 than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④④">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a>: unscathed
@@ -11688,7 +11693,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dictdef-authenticationextensionsprfinputs": {"dfnID":"dictdef-authenticationextensionsprfinputs","dfnText":"AuthenticationExtensionsPRFInputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsprfinputs"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationextensionsprfinputs"},
 "dictdef-authenticationextensionsprfoutputs": {"dfnID":"dictdef-authenticationextensionsprfoutputs","dfnText":"AuthenticationExtensionsPRFOutputs","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsprfoutputs"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationextensionsprfoutputs"},
 "dictdef-authenticationextensionsprfvalues": {"dfnID":"dictdef-authenticationextensionsprfvalues","dfnText":"AuthenticationExtensionsPRFValues","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationextensionsprfvalues"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2460"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2461"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2462"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2463"},{"id":"ref-for-dictdef-authenticationextensionsprfvalues\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationextensionsprfvalues"},
-"dictdef-authenticationresponsejson": {"dfnID":"dictdef-authenticationresponsejson","dfnText":"AuthenticationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticationresponsejson"},
+"dictdef-authenticationresponsejson": {"dfnID":"dictdef-authenticationresponsejson","dfnText":"AuthenticationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dictdef-authenticationresponsejson\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-authenticationresponsejson"},
 "dictdef-authenticatorassertionresponsejson": {"dfnID":"dictdef-authenticatorassertionresponsejson","dfnText":"AuthenticatorAssertionResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticatorassertionresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticatorassertionresponsejson"},
 "dictdef-authenticatorattestationresponsejson": {"dfnID":"dictdef-authenticatorattestationresponsejson","dfnText":"AuthenticatorAttestationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticatorattestationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-authenticatorattestationresponsejson"},
 "dictdef-authenticatorselectioncriteria": {"dfnID":"dictdef-authenticatorselectioncriteria","dfnText":"AuthenticatorSelectionCriteria","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-authenticatorselectioncriteria"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2460"},{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2462"},{"id":"ref-for-dictdef-authenticatorselectioncriteria\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"}],"url":"#dictdef-authenticatorselectioncriteria"},
@@ -11706,7 +11711,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dictdef-publickeycredentialrpentity": {"dfnID":"dictdef-publickeycredentialrpentity","dfnText":"PublicKeyCredentialRpEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2460"},{"id":"ref-for-dictdef-publickeycredentialrpentity\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2462"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2463"},{"id":"ref-for-dictdef-publickeycredentialrpentity\u2464"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialrpentity\u2465"}],"title":"6.3.2. The authenticatorMakeCredential Operation"}],"url":"#dictdef-publickeycredentialrpentity"},
 "dictdef-publickeycredentialuserentity": {"dfnID":"dictdef-publickeycredentialuserentity","dfnText":"PublicKeyCredentialUserEntity","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2461"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2462"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2463"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2465"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2466"},{"id":"ref-for-dictdef-publickeycredentialuserentity\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentity\u2468"}],"title":"14.4.2. Privacy of personally identifying information Stored in Authenticators"}],"url":"#dictdef-publickeycredentialuserentity"},
 "dictdef-publickeycredentialuserentityjson": {"dfnID":"dictdef-publickeycredentialuserentityjson","dfnText":"PublicKeyCredentialUserEntityJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-publickeycredentialuserentityjson"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"}],"url":"#dictdef-publickeycredentialuserentityjson"},
-"dictdef-registrationresponsejson": {"dfnID":"dictdef-registrationresponsejson","dfnText":"RegistrationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-registrationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dictdef-registrationresponsejson"},
+"dictdef-registrationresponsejson": {"dfnID":"dictdef-registrationresponsejson","dfnText":"RegistrationResponseJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-registrationresponsejson"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dictdef-registrationresponsejson\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dictdef-registrationresponsejson"},
 "dictdef-tokenbinding": {"dfnID":"dictdef-tokenbinding","dfnText":"TokenBinding","external":false,"refSections":[],"url":"#dictdef-tokenbinding"},
 "dictdef-unknowncredentialoptions": {"dfnID":"dictdef-unknowncredentialoptions","dfnText":"UnknownCredentialOptions","external":false,"refSections":[{"refs":[{"id":"ref-for-dictdef-unknowncredentialoptions"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-dictdef-unknowncredentialoptions\u2460"}],"title":"5.1.10.2. signalUnknownCredential(options)"}],"url":"#dictdef-unknowncredentialoptions"},
 "discoverable-credential": {"dfnID":"discoverable-credential","dfnText":"Discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-discoverable-credential"},{"id":"ref-for-discoverable-credential\u2460"},{"id":"ref-for-discoverable-credential\u2461"},{"id":"ref-for-discoverable-credential\u2462"},{"id":"ref-for-discoverable-credential\u2463"},{"id":"ref-for-discoverable-credential\u2464"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-discoverable-credential\u2465"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-discoverable-credential\u2466"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-discoverable-credential\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-discoverable-credential\u2468"},{"id":"ref-for-discoverable-credential\u2460\u24ea"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2460"},{"id":"ref-for-discoverable-credential\u2460\u2461"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2462"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHint)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2465"},{"id":"ref-for-discoverable-credential\u2460\u2466"},{"id":"ref-for-discoverable-credential\u2460\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-discoverable-credential\u2460\u2468"},{"id":"ref-for-discoverable-credential\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"}],"url":"#discoverable-credential"},
@@ -11741,7 +11746,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-authenticationextensionsprfinputs-eval": {"dfnID":"dom-authenticationextensionsprfinputs-eval","dfnText":"eval","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2464"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2465"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2466"},{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-eval\u2468"}],"title":"10.1.4.1. Test vectors: Web Authentication API"}],"url":"#dom-authenticationextensionsprfinputs-eval"},
 "dom-authenticationextensionsprfinputs-evalbycredential": {"dfnID":"dom-authenticationextensionsprfinputs-evalbycredential","dfnText":"evalByCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2460"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2461"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2462"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2463"},{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2464"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfinputs-evalbycredential\u2465"}],"title":"10.1.4.1. Test vectors: Web Authentication API"}],"url":"#dom-authenticationextensionsprfinputs-evalbycredential"},
 "dom-authenticationextensionsprfoutputs-enabled": {"dfnID":"dom-authenticationextensionsprfoutputs-enabled","dfnText":"enabled","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-enabled\u2462"}],"title":"10.1.4.1. Test vectors: Web Authentication API"}],"url":"#dom-authenticationextensionsprfoutputs-enabled"},
-"dom-authenticationextensionsprfoutputs-results": {"dfnID":"dom-authenticationextensionsprfoutputs-results","dfnText":"results","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2461"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2462"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2463"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2464"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2465"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2466"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfoutputs-results"},
+"dom-authenticationextensionsprfoutputs-results": {"dfnID":"dom-authenticationextensionsprfoutputs-results","dfnText":"results","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2460"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2461"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2462"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2463"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2464"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2465"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2466"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2467"},{"id":"ref-for-dom-authenticationextensionsprfoutputs-results\u2468"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfoutputs-results"},
 "dom-authenticationextensionsprfvalues-first": {"dfnID":"dom-authenticationextensionsprfvalues-first","dfnText":"first","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2462"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2463"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2464"},{"id":"ref-for-dom-authenticationextensionsprfvalues-first\u2465"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfvalues-first"},
 "dom-authenticationextensionsprfvalues-second": {"dfnID":"dom-authenticationextensionsprfvalues-second","dfnText":"second","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2461"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2463"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2464"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2465"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2466"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2467"}],"title":"10.1.4.1. Test vectors: Web Authentication API"},{"refs":[{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2468"},{"id":"ref-for-dom-authenticationextensionsprfvalues-second\u2460\u24ea"}],"title":"10.1.4.2. Test vectors: CTAP2 hmac-secret extension"}],"url":"#dom-authenticationextensionsprfvalues-second"},
 "dom-authenticationresponsejson-authenticatorattachment": {"dfnID":"dom-authenticationresponsejson-authenticatorattachment","dfnText":"authenticatorAttachment","external":false,"refSections":[],"url":"#dom-authenticationresponsejson-authenticatorattachment"},
@@ -11844,7 +11849,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "dom-publickeycredential-store-credential-sameoriginwithancestors-credential": {"dfnID":"dom-publickeycredential-store-credential-sameoriginwithancestors-credential","dfnText":"credential","external":false,"refSections":[],"url":"#dom-publickeycredential-store-credential-sameoriginwithancestors-credential"},
 "dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors": {"dfnID":"dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors","dfnText":"sameOriginWithAncestors","external":false,"refSections":[],"url":"#dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors"},
 "dom-publickeycredential-store-slot": {"dfnID":"dom-publickeycredential-store-slot","dfnText":"[[Store]](credential, sameOriginWithAncestors)","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-store-slot"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-publickeycredential-store-slot"},
-"dom-publickeycredential-tojson": {"dfnID":"dom-publickeycredential-tojson","dfnText":"toJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-tojson"}],"title":"5.1. PublicKeyCredential Interface"}],"url":"#dom-publickeycredential-tojson"},
+"dom-publickeycredential-tojson": {"dfnID":"dom-publickeycredential-tojson","dfnText":"toJSON","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredential-tojson"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-dom-publickeycredential-tojson\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"}],"url":"#dom-publickeycredential-tojson"},
 "dom-publickeycredential-type-slot": {"dfnID":"dom-publickeycredential-type-slot","dfnText":"[[type]]","external":false,"refSections":[],"url":"#dom-publickeycredential-type-slot"},
 "dom-publickeycredentialcreationoptions-attestation": {"dfnID":"dom-publickeycredentialcreationoptions-attestation","dfnText":"attestation","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation"},{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2460"},{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2462"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestation\u2463"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestation"},
 "dom-publickeycredentialcreationoptions-attestationformats": {"dfnID":"dom-publickeycredentialcreationoptions-attestationformats","dfnText":"attestationFormats","external":false,"refSections":[{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2460"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-dom-publickeycredentialcreationoptions-attestationformats\u2461"}],"title":"6.5. Attestation"}],"url":"#dom-publickeycredentialcreationoptions-attestationformats"},
@@ -11984,7 +11989,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "public-key-credential-source-userhandle": {"dfnID":"public-key-credential-source-userhandle","dfnText":"userHandle","external":false,"refSections":[{"refs":[{"id":"ref-for-public-key-credential-source-userhandle"}],"title":"5.1.10.2. signalUnknownCredential(options)"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2460"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2461"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2462"},{"id":"ref-for-public-key-credential-source-userhandle\u2463"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2464"}],"title":"6.3.5. The silentCredentialDiscovery operation"},{"refs":[{"id":"ref-for-public-key-credential-source-userhandle\u2465"},{"id":"ref-for-public-key-credential-source-userhandle\u2466"}],"title":"11.5. Add Credential"}],"url":"#public-key-credential-source-userhandle"},
 "publickey-credentials-create-feature": {"dfnID":"publickey-credentials-create-feature","dfnText":"publickey-credentials-create","external":false,"refSections":[],"url":"#publickey-credentials-create-feature"},
 "publickey-credentials-get-feature": {"dfnID":"publickey-credentials-get-feature","dfnText":"publickey-credentials-get","external":false,"refSections":[{"refs":[{"id":"ref-for-publickey-credentials-get-feature"}],"title":"5.10. Using Web Authentication within iframe elements"}],"url":"#publickey-credentials-get-feature"},
-"publickeycredential": {"dfnID":"publickeycredential","dfnText":"PublicKeyCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-publickeycredential\u2460"},{"id":"ref-for-publickeycredential\u2461"},{"id":"ref-for-publickeycredential\u2462"},{"id":"ref-for-publickeycredential\u2463"},{"id":"ref-for-publickeycredential\u2464"},{"id":"ref-for-publickeycredential\u2465"},{"id":"ref-for-publickeycredential\u2466"},{"id":"ref-for-publickeycredential\u2467"},{"id":"ref-for-publickeycredential\u2468"},{"id":"ref-for-publickeycredential\u2460\u24ea"},{"id":"ref-for-publickeycredential\u2460\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2461"},{"id":"ref-for-publickeycredential\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2463"},{"id":"ref-for-publickeycredential\u2460\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2466"},{"id":"ref-for-publickeycredential\u2460\u2467"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2461"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2462"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2464"},{"id":"ref-for-publickeycredential\u2461\u2465"},{"id":"ref-for-publickeycredential\u2461\u2466"},{"id":"ref-for-publickeycredential\u2461\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2468"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2461"}],"title":"13.4.4. Attestation Limitations"}],"url":"#publickeycredential"},
+"publickeycredential": {"dfnID":"publickeycredential","dfnText":"PublicKeyCredential","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-publickeycredential\u2460"},{"id":"ref-for-publickeycredential\u2461"},{"id":"ref-for-publickeycredential\u2462"},{"id":"ref-for-publickeycredential\u2463"},{"id":"ref-for-publickeycredential\u2464"},{"id":"ref-for-publickeycredential\u2465"},{"id":"ref-for-publickeycredential\u2466"},{"id":"ref-for-publickeycredential\u2467"},{"id":"ref-for-publickeycredential\u2468"},{"id":"ref-for-publickeycredential\u2460\u24ea"},{"id":"ref-for-publickeycredential\u2460\u2460"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2461"},{"id":"ref-for-publickeycredential\u2460\u2462"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2463"},{"id":"ref-for-publickeycredential\u2460\u2464"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2465"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2466"},{"id":"ref-for-publickeycredential\u2460\u2467"}],"title":"5.1.5. Store an Existing Credential - PublicKeyCredential\u2019s [[Store]](credential, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential\u2460\u2468"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u24ea"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2460"}],"title":"5.1.8. Deserialize Registration ceremony options - PublicKeyCredential\u2019s parseCreationOptionsFromJSON() Method"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2461"}],"title":"5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential\u2019s parseRequestOptionsFromJSON() Methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2462"}],"title":"5.1.10. Signal Credential Changes to the Authenticator - PublicKeyCredential\u2019s signal methods"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2463"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2464"},{"id":"ref-for-publickeycredential\u2461\u2465"},{"id":"ref-for-publickeycredential\u2461\u2466"},{"id":"ref-for-publickeycredential\u2461\u2467"}],"title":"5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)"},{"refs":[{"id":"ref-for-publickeycredential\u2461\u2468"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2460"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2461"},{"id":"ref-for-publickeycredential\u2462\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-publickeycredential\u2462\u2463"}],"title":"13.4.4. Attestation Limitations"}],"url":"#publickeycredential"},
 "publickeycredential-issuing-a-credential-request-to-an-authenticator": {"dfnID":"publickeycredential-issuing-a-credential-request-to-an-authenticator","dfnText":"Issuing a Credential Request to an Authenticator","external":false,"refSections":[{"refs":[{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator"},{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator\u2461"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"}],"url":"#publickeycredential-issuing-a-credential-request-to-an-authenticator"},
 "rate-limiting": {"dfnID":"rate-limiting","dfnText":"Rate Limiting","external":false,"refSections":[{"refs":[{"id":"ref-for-rate-limiting"},{"id":"ref-for-rate-limiting\u2460"}],"title":"4. Terminology"}],"url":"#rate-limiting"},
 "recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"dfnID":"recommended-range-and-default-for-a-webauthn-ceremony-timeout","dfnText":"recommended range and default for a WebAuthn ceremony timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Internal Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},