diff --git a/index.bs b/index.bs index 06bcd0af9..0733504f9 100644 --- a/index.bs +++ b/index.bs @@ -32,6 +32,7 @@ Former Editor: Angelo Liao, w3cid 94342, Microsoft, huliao@microsoft.com Former Editor: Rolf Lindemann, w3cid 84447, Nok Nok Labs, rolf@noknok.com !Contributors: John Bradley (Yubico) !Contributors: Christiaan Brand (Google) +!Contributors: Tim Cappalli (Microsoft) !Contributors: Adam Langley (Google) !Contributors: Giridhar Mandyam (Qualcomm) !Contributors: Matthew Miller (Cisco) @@ -971,6 +972,24 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S consent=] for (i.e., authorizes) a [=ceremony=] to proceed. This MAY involve [=user verification=] if the employed [=authenticator=] is capable, or it MAY involve a simple [=test of user presence=]. +: Backup +: Backed Up +:: [=Public Key Credential Sources=] may be backed up in some fashion such that they may become present on an authenticator other + than their [=generating authenticator=]. Backup can occur via mechanisms including but not limited to peer-to-peer sync, + cloud sync, local network sync, and manual import/export. See also [[#sctn-credential-backup]]. + +: Backup Eligibility +: Backup Eligible +:: A [=Public Key Credential Source=]'s [=generating authenticator=] determines at creation time whether the [=public key credential source=] + is allowed to be [=backed up=]. Backup eligibility is signaled in [=authenticator data=]'s [=flags=] along with the current [=backup state=]. + Backup eligibility is a [=credential property=] and is permanent for a given [=public key credential source=]. + A backup eligible [=public key credential source=] is referred to as a multi-device credential whereas one that is not + backup eligible is referred to as a single-device credential. See also [[#sctn-credential-backup]]. + +: Backup State +:: The current backup state of a [=multi-device credential=] as determined by the current [=managing authenticator=]. Backup state is + signaled in [=authenticator data=]'s [=flags=] and can change over time. See also [=backup eligibility=] and [[#sctn-credential-backup]]. + : Biometric Recognition :: The automated recognition of individuals based on their biological and behavioral characteristics [[ISOBiometricVocabulary]]. @@ -1097,6 +1116,12 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S :: A [=credential property=] is some characteristic property of a [=public key credential source=], such as whether it is a [=client-side discoverable credential=] or a [=server-side credential=]. +: Generating Authenticator +:: The Generating Authenticator is the authenticator involved in the [=authenticatorMakeCredential=] operation resulting + in the creation of a given [=pubic key credential source=]. The [=generating authenticator=] is the same as the [=managing authenticator=] + for [=single-device credentials=]. For [=multi-device credentials=], the generating authenticator may or may not be the same as the + current [=managing authenticator=] participating in a given [=authentication=] operation. + : Human Palatability :: An identifier that is [=human palatability|human-palatable=] is intended to be rememberable and reproducible by typical human users, in contrast to identifiers that are, for example, randomly generated sequences of bits [[EduPersonObjectClassSpec]]. @@ -3544,7 +3569,13 @@ laid out as shown in Table Table . + +The value of the `BE` [=flag=] is set during [=authenticatorMakeCredential=] operation and MUST NOT change. + +The value of the `BS` [=flag=] may change over time based on the current state of the [=Public Key Credential Source|credential source=]. Table below defines +valid combinations and their meaning. + +
+ + + + + + + + + + + + + + + + + + + + + + + + + + +
`BE``BS`Description
`0``0` + The credential is a [=single-device credential=]. +
`0``1` + This combination is not allowed. +
`1``0` + The credential is a [=multi-device credential=] and is not yet backed up. +
`1``1` + The credential is a [=multi-device credential=] and is backed up. +
+
+ `BE` and `BS` [=flag=] combinations +
+
+ +It is RECOMMENDED that [=[RPS]=] store the most recent value of these [=flags=] with the [=user account=] for future evaluation. + +The following is a non-normative, non-exhaustive list of how [=[RPS]=] might use these [=flags=]: + + - Requiring additional [=authenticators=]: + When `BE` [=flag=] is set to `0`, the credential is a [=single-device credential=] and the [=generating authenticator=] will never + allow the credential to be backed up. + + A [=single-device credential=] is not resilient to single device loss. [=[RPS]=] SHOULD ensure that a [=user account=] + has additional [=authenticators=] [=registration ceremony|registered=] and/or an account recovery process in place. + + For example, the user could be prompted to set up an additional [=authenticator=], such as a [=roaming authenticator=] or an + [=authenticator=] that is capable of [=multi-device credentials=]. + + - Upgrading a user to a password-free account: + + When the `BS` [=flag=] changes from `0` to `1`, the [=authenticator=] is signaling that the [=credential=] is backed up and is protected from single device loss. + + A [=Relying Party=] may decide to prompt the user to upgrade their account security and remove their password. + + - Adding an additional factor after a state change: + + When the `BS` [=flag=] changes from `1` to `0`, the [=authenticator=] is signaling that the [=credential=] is no longer backed up, + and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service, + or errors, such as issues with the backup service. + + When this transition occurs, the [=Relying Party=] SHOULD guide the user through a process to validate their other sign in factors. + If the user does not have another credential for their account, they SHOULD be guided through adding an additional authentication factor + to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional [=authenticator=], + such as a [=roaming authenticator=] or an [=authenticator=] that is capable of [=multi-device credentials=]. + ## Authenticator Taxonomy ## {#sctn-authenticator-taxonomy} Many use cases are dependent on the capabilities of the [=authenticator=] used. @@ -4580,6 +4693,12 @@ In order to perform a [=registration ceremony=], the [=[RP]=] MUST proceed as fo 1. If [=user verification=] is required for this registration, verify that the [=User Verified=] bit of the [=flags=] in |authData| is set. +1. If the [=[RP]=] uses the credential's [=backup eligibility=] to inform its user experience flows and/or policies, evaluate the + [=backup eligibility=] (BE) bit of the [=flags=] in |authData|. + +1. If the [=[RP]=] uses the credential's [=backup state=] to inform its user experience flows and/or policies, evaluate the [=backup state=] (BS) + bit of the [=flags=] in |authData|, and then store the value for evaluation in future [=authentication ceremonies=]. + 1. Verify that the "alg" parameter in the [=credentialPublicKey|credential public key=] in |authData| matches the {{PublicKeyCredentialParameters/alg}} attribute of one of the [=list/items=] in |options|.{{PublicKeyCredentialCreationOptions/pubKeyCredParams}}. @@ -4747,6 +4866,9 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o 1. If [=user verification=] is required for this assertion, verify that the [=User Verified=] bit of the [=flags=] in |authData| is set. +1. If the credential [=backup state=] is used as part of Relying Party business logic or policy, compare the previously stored + value with the [=backup state=] (BS) bit of the [=flags=] in |authData|, perform evaluation, and then store the new value. + 1. Verify that the values of the [=client extension outputs=] in |clientExtensionResults| and the [=authenticator extension outputs=] in the [=authdataextensions|extensions=] in |authData| are as expected, considering the [=client extension input=] values that were given in |options|.{{PublicKeyCredentialRequestOptions/extensions}}