From 2e4e2e0b57a813f9878709c83bd7c4869684bde3 Mon Sep 17 00:00:00 2001
From: Emil Lundberg <emil@yubico.com>
Date: Wed, 11 Sep 2024 18:13:02 +0000
Subject: [PATCH] Merge pull request #2141 from w3c/2064-tc-bebs-steps

SHA: 2e757932a8584aad34dfc0593d9b728d6b602f8c
Reason: push, by emlun

Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---
 index.html | 147 ++++++++++++++++++++++++++++-------------------------
 1 file changed, 77 insertions(+), 70 deletions(-)

diff --git a/index.html b/index.html
index ab96eee3d..da5fb7b46 100644
--- a/index.html
+++ b/index.html
@@ -6,7 +6,7 @@
   <meta content="ED" name="w3c-status">
   <meta content="Bikeshed version 6270e4735, updated Tue Aug 6 12:12:30 2024 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="a871f796c591721c9556f119924ee29484b441f5" name="revision">
+  <meta content="2e757932a8584aad34dfc0593d9b728d6b602f8c" name="revision">
   <meta content="dark light" name="color-scheme">
 <style type="text/css">
 body {
@@ -965,7 +965,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-08-28">28 August 2024</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2024-09-11">11 September 2024</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -5270,10 +5270,17 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
 possibly combined in a single <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑤">authorization gesture</a>,
 then the authenticator will set both the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up①">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①③">flag</a> and the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑧">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①④">flag</a>.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑥">attestation signatures</a>, the authenticator MUST set the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑤">flag</a> and include the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata②">attestedCredentialData</a></code>.
-For <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑤">assertion signatures</a>, the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at①">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑥">flag</a> MUST NOT be set and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata③">attestedCredentialData</a></code> MUST NOT be included.</p>
+     <p>The <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑤">flag</a> SHALL be set if and only if the credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credential</a>.
+This value MUST NOT change after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration ceremony</a> as defined in <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
     <li data-md>
-     <p>If the authenticator does not include any <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions①">extension data</a>, it MUST set the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑦">flag</a> to zero, and to one if <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions②">extension data</a> is included.</p>
+     <p>The <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑥">flag</a> SHALL be set if and only if the credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>.</p>
+     <p>If the backup status of a credential is uncertain or the authenticator suspects a problem with the backed up credential,
+    the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑦">flag</a> SHOULD NOT be set.</p>
+    <li data-md>
+     <p>For <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑥">attestation signatures</a>, the authenticator MUST set the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑧">flag</a> and include the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata②">attestedCredentialData</a></code>.
+For <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑤">assertion signatures</a>, the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at①">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑨">flag</a> MUST NOT be set and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata③">attestedCredentialData</a></code> MUST NOT be included.</p>
+    <li data-md>
+     <p>If the authenticator does not include any <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions①">extension data</a>, it MUST set the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⓪">flag</a> to zero, and to one if <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions②">extension data</a> is included.</p>
    </ul>
    <p><a href="#fig-authData">Figure <span class="figure-num-following"></span></a> shows a visual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> structure.</p>
    <figure id="fig-authData">
@@ -5281,8 +5288,8 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
     <figcaption><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑦">Authenticator data</a> layout.</figcaption>
    </figure>
    <div class="note" role="note">
-     Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> describes its own length: If the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at②">AT</a> and <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed①">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑧">flags</a> are not set, it is always 37 bytes long.
-    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑨">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⓪">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②①">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
+     Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> describes its own length: If the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at②">AT</a> and <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed①">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②①">flags</a> are not set, it is always 37 bytes long.
+    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
     follows. 
     <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc9052#section-7" id="ref-for-section-7">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc9052" title="CBOR Object Signing and Encryption (COSE): Structures and Process">[RFC9052]</a>).</p>
    </div>
@@ -5306,20 +5313,20 @@ <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span clas
    <h4 class="heading settled" data-level="6.1.2" id="sctn-fido-u2f-sig-format-compat"><span class="secno">6.1.2. </span><span class="content">FIDO U2F Signature Format Compatibility</span><a class="self-link" href="#sctn-fido-u2f-sig-format-compat"></a></h4>
    <p>The format for <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑥">assertion signatures</a>, which sign over the concatenation of an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a> structure and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑦">hash
 of the serialized client data</a>, are compatible with the FIDO U2F authentication signature format (see <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success" id="ref-for-authentication-response-message-success">Section 5.4</a> of <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats" title="FIDO U2F Raw Message Formats">[FIDO-U2F-Message-Formats]</a>).</p>
-   <p>This is because the first 37 bytes of the signed data in a FIDO U2F authentication response message constitute a valid <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③④">authenticator data</a> structure, and the remaining 32 bytes are the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">hash of the serialized client data</a>. In this <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑤">authenticator data</a> structure, the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash①">rpIdHash</a></code> is the FIDO U2F <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate" id="ref-for-authentication-request-message---u2f_authenticate">application parameter</a>, all <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flags</a></code> except <code><a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up②">UP</a></code> are always zero, and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata④">attestedCredentialData</a></code> and <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions④">extensions</a></code> are never present. FIDO U2F authentication signatures can therefore be verified by
+   <p>This is because the first 37 bytes of the signed data in a FIDO U2F authentication response message constitute a valid <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③④">authenticator data</a> structure, and the remaining 32 bytes are the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">hash of the serialized client data</a>. In this <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑤">authenticator data</a> structure, the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash①">rpIdHash</a></code> is the FIDO U2F <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate" id="ref-for-authentication-request-message---u2f_authenticate">application parameter</a>, all <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flags</a></code> except <code><a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up②">UP</a></code> are always zero, and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata④">attestedCredentialData</a></code> and <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions④">extensions</a></code> are never present. FIDO U2F authentication signatures can therefore be verified by
 the same procedure as other <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑦">assertion signatures</a> generated by the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①③">authenticatorGetAssertion</a> operation.</p>
    <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span class="secno">6.1.3. </span><span class="content">Credential Backup State</span><a class="self-link" href="#sctn-credential-backup"></a></h4>
-   <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
+   <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs③">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
 defined in <a href="#table-authData">Table <span class="table-ref-previous"></span></a>.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
-   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be③">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
 valid combinations and their meaning.</p>
    <figure class="table" id="table-backupStates">
     <table class="complex data longlastcol">
      <tbody>
       <tr>
-       <th><a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be③">BE</a>
-       <th><a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs③">BS</a>
+       <th><a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a>
+       <th><a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a>
        <th>Description
       <tr>
        <td><code>0</code>
@@ -5332,36 +5339,36 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
       <tr>
        <td><code>1</code>
        <td><code>0</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
       <tr>
        <td><code>1</code>
        <td><code>1</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up⑤">backed up</a>. 
     </table>
-    <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flag</a> combinations </figcaption>
+    <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
-   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flags</a>:</p>
    <ul>
     <li data-md>
      <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticators</a>:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registered</a> and/or an account recovery process in place.
-For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credentials</a>.</p>
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registered</a> and/or an account recovery process in place.
+For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑥">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a> is backed up and is protected from single device loss.</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a> is backed up and is protected from single device loss.</p>
      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
-     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a> is no longer backed up,
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a> is no longer backed up,
 and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
      <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
 If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
 to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a>,
-such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
+such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑦">multi-device credentials</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><span class="secno">6.2. </span><span class="content">Authenticator Taxonomy</span><a class="self-link" href="#sctn-authenticator-taxonomy"></a></h3>
    <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> used.
@@ -5517,8 +5524,8 @@ <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-ca
 verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> can
 verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> that is
 not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑥">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client①⑨">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
@@ -6209,14 +6216,14 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
 The signature is not ASN.1 wrapped.</p>
    </ul>
    <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①①">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
    <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a>'s script receives
 a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑧">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
 respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> server, using methods outside
 the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
      <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions" id="ref-for-dictdef-credentialcreationoptions③">CredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a>'s needs for the ceremony.
@@ -6268,16 +6275,16 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
     <li data-md>
      <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a>.</p>
     <li data-md>
-     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flags</a></code> in <var>authData</var> is set, unless <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑦">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑤">conditional</a></code>.</p>
+     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var> is set, unless <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialcreationoptions-mediation" id="ref-for-dom-credentialcreationoptions-mediation⑦">mediation</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②⑤">conditional</a></code>.</p>
     <li data-md>
      <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> for this registration,
-verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
+verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①②">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit is not set.</p>
+     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> bit is not set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
      <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams⑥">pubKeyCredParams</a></code></code>.</p>
     <li id="reg-ceremony-verify-extension-outputs">
@@ -6315,9 +6322,9 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
 (i.e., it and the root certificate obtained in <a href="#reg-ceremony-attestation-trust-anchors">step 23</a> may be the same).</p>
      </ul>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
      <p class="note" role="note"><span class="marker">NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li id="reg-ceremony-store-credential-record">
      <a class="self-link" href="#reg-ceremony-store-credential-record"></a> If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
@@ -6339,16 +6346,16 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
        <p><code><var>authData</var>.<a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount⑤">signCount</a></code>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-uvinitialized" id="ref-for-abstract-opdef-credential-record-uvinitialized②">uvInitialized</a>
       <dd data-md>
-       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①③">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flag</a> in <var>authData</var>.</p>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①③">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flag</a> in <var>authData</var>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-transports" id="ref-for-abstract-opdef-credential-record-transports②">transports</a>
       <dd data-md>
        <p>The value returned from <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code></code>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible">backupEligible</a>
       <dd data-md>
-       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flag</a> in <var>authData</var>.</p>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑨">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④④">flag</a> in <var>authData</var>.</p>
       <dt data-md><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate">backupState</a>
       <dd data-md>
-       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④②">flag</a> in <var>authData</var>.</p>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flag</a> in <var>authData</var>.</p>
      </dl>
      <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a> MAY also include the following OPTIONAL contents:</p>
      <dl>
@@ -6361,7 +6368,7 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      </dl>
     <li data-md>
      <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per <a href="#reg-ceremony-assess-trust">step 24</a> above,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremony</a>.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> SHOULD fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a>.</p>
      <p class="note" role="note"><span class="marker">NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a> and credential public key but treat the
     credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a> is asserting there
     is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a> model.
@@ -6439,18 +6446,18 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
      <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④②">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a>. 
      <p class="note" role="note"><span class="marker">Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
-     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④③">flags</a></code> in <var>authData</var> is set.</p>
+     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
      <p>Determine whether <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">user verification</a> is required for this assertion. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">User verification</a> SHOULD be required if, and only if, <code><var>pkOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification④">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑦">required</a></code>.</p>
      <p>If <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a> was determined to be required,
-verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①④">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④④">flags</a></code> in <var>authData</var> is set.
-Otherwise, ignore the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑤">flag</a>.</p>
+verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①④">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a></code> in <var>authData</var> is set.
+Otherwise, ignore the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑨">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑥">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> bit is not set.</p>
+     <p>If the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a></code> in <var>authData</var> is not set, verify that the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> bit is not set.</p>
     <li data-md>
      <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a> business logic or policy,
-let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①⓪">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①①">BS</a> bits, respectively,
-of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑦">flags</a></code> in <var>authData</var>.
+let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①③">BS</a> bits, respectively,
+of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flags</a></code> in <var>authData</var>.
 Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupeligible" id="ref-for-abstract-opdef-credential-record-backupeligible①">backupEligible</a></code> and <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate①">backupState</a></code>:</p>
      <ol>
       <li data-md>
@@ -6460,7 +6467,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
       <li data-md>
        <p>Apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> policy, if any.</p>
      </ol>
-     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑧">flag</a> values.</p>
+     <p class="note" role="note"><span class="marker">Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> values.</p>
     <li id="authn-ceremony-verify-extension-outputs">
      <a class="self-link" href="#authn-ceremony-verify-extension-outputs"></a> Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension
     outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client
@@ -6504,7 +6511,7 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
        <p>Update <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-backupstate" id="ref-for-abstract-opdef-credential-record-backupstate②">backupState</a></code> to the value of <var>currentBs</var>.</p>
       <li data-md>
        <p>If <code><var>credentialRecord</var>.<a data-link-type="abstract-op" href="#abstract-opdef-credential-record-uvinitialized" id="ref-for-abstract-opdef-credential-record-uvinitialized③">uvInitialized</a></code> is <code>false</code>,
-update it to the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑥">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⑨">flags</a> in <var>authData</var>.
+update it to the value of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑥">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flags</a> in <var>authData</var>.
 This change SHOULD require authorization by an additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②④">authentication factor</a> equivalent to WebAuthn <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>;
 if not authorized, skip this step.</p>
      </ol>
@@ -7515,7 +7522,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
     <dd data-md>
      <ol>
       <li data-md>
-       <p>If processed during a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a>:</p>
+       <p>If processed during a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremony</a>:</p>
        <ol>
         <li data-md>
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①">rk</a></code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②⓪">authenticatorMakeCredential</a> operation.</p>
@@ -7540,7 +7547,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①">boolean</a></span>
        <dd data-md>
         <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn>,
-is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑨">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
+is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑨">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
 If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
@@ -7550,7 +7557,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
         <p>This OPTIONAL property is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability⑦">human-palatable</a> description of the credential’s <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①②">managing authenticator</a>,
 chosen by the user.</p>
         <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> MUST allow the user to choose this value.
-That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication</a> ceremony or MAY be made available outside
+That choice MAY be presented during the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication</a> ceremony or MAY be made available outside
 the ceremony, for example in client settings. The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> MAY reuse the same value
 for multiple credentials with the same <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①③">managing authenticator</a> across multiple <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Parties</a>.</p>
         <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> MAY query the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticator</a>, by some unspecified mechanism, for this
@@ -7560,7 +7567,7 @@ <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credentia
 and SHOULD allow the user to modify a vendor-provided default response.</p>
         <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> includes an <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname">authenticatorDisplayName</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①②">item</a> in its <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑧">credential records</a>,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> MAY offer this <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname④">authenticatorDisplayName</a></code> extension output,
-if present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremony</a>.</p>
+if present, as a default value for the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname①">authenticatorDisplayName</a></code> of the new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⑨">credential record</a> it stores after a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a>.</p>
         <p>If the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-authenticatordisplayname" id="ref-for-dom-credentialpropertiesoutput-authenticatordisplayname⑤">authenticatorDisplayName</a></code> extension output from an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremony</a> is different from the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname②">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②⓪">credential record</a>,
 the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> MAY offer the user to update the <code><a data-link-type="abstract-op" href="#abstract-opdef-credential-record-authenticatordisplayname" id="ref-for-abstract-opdef-credential-record-authenticatordisplayname③">authenticatorDisplayName</a></code> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②①">credential record</a>.</p>
       </dl>
@@ -7951,11 +7958,11 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
     <dt data-md><var>defaultBackupEligibility</var>
     <dd data-md>
      <p>Determines the default state of the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties④">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑨">Public Key Credential Source</a>.
-This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①①">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤③">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⓪">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">virtual authenticator</a>.</p>
+This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤③">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②①">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①①">virtual authenticator</a>.</p>
     <dt data-md><var>defaultBackupState</var>
     <dd data-md>
      <p>Determines the default state of the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties⑤">credential property</a> for any newly created <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⓪">Public Key Credential Source</a>.
-This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①③">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤④">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤①">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
+This value MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑤">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤④">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> when performing an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②②">authenticatorMakeCredential</a> operation with this <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①②">virtual authenticator</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-authenticator"><span class="secno">11.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-virtual-authenticator">Add Virtual Authenticator</dfn></span><a class="self-link" href="#sctn-automation-add-virtual-authenticator"></a></h3>
    <p>The <a data-link-type="dfn" href="#add-virtual-authenticator" id="ref-for-add-virtual-authenticator">Add Virtual Authenticator</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-commands" id="ref-for-dfn-extension-commands③">extension command</a> creates a software <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①③">Virtual Authenticator</a>. It is
@@ -8158,13 +8165,13 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
       <tr>
        <td><var>backupEligibility</var>
        <td> The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑤">backup eligibility</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦④">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑨">virtual authenticator</a>'s <var>defaultBackupEligibility</var> property.
-                    The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑥">backup eligibility</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①②">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑤">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤②">flag</a> when performing
+                    The simulated <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility⑥">backup eligibility</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①③">BE</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑤">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑤">flag</a> when performing
                     an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②①">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑤">public key credential source</a>. 
        <td>boolean
       <tr>
        <td><var>backupState</var>
        <td> The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑥">public key credential source</a>. If unset, the value will default to the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">virtual authenticator</a>'s <var>defaultBackupState</var> property.
-                    The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑦">backup state</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①④">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑥">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤③">flag</a> when performing
+                    The simulated <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑦">backup state</a> MUST be reflected by the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⑥">BS</a> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⑥">authenticator data</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑥">flag</a> when performing
                     an <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②②">authenticatorGetAssertion</a> operation with this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑦⑦">public key credential source</a>. 
        <td>boolean
     </table>
@@ -8600,7 +8607,7 @@ <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span clas
 enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
-Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
+Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">user verification</a> - for example PIN, biometrics and/or future
 methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a>.</p>
@@ -8635,7 +8642,7 @@ <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations
 For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> script.
 The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑨">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> maintains
 confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">public key
 credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
    <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential③⓪">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
@@ -8811,7 +8818,7 @@ <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span
 not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦①">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑨">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪⓪">Relying Party</a> therefore cannot discover the
 user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪①">Relying Party</a> cannot expose biometric data for an attacker to
 use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪②">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> response,
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪③">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⓪">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⑦">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤⑦">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a> response,
 instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⓪④">Relying Party</a>.</p>
    <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⑨">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
@@ -8893,7 +8900,7 @@ <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><s
 function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①③">Relying Party</a>, since hashing does not prevent probing for guessable input
 values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③①">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Party</a> might leak sensitive
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑦">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦⑤">WebAuthn Relying Party</a> might leak sensitive
 information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①④">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
 initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑤">Relying Party</a> responds with a failure, but then
 successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⑧">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
@@ -8903,15 +8910,15 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②②">registration ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④①⑨">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②⓪">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②③">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②④">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span class="marker">Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②①">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
 mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②②">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②③">Relying Parties</a>.</p>
        </ul>
@@ -8919,7 +8926,7 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④②④">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
-         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑤">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
+         <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
 send a message to this address, containing an unpredictable one-time code and instructions for how to use it to
 proceed with the ceremony. Display the same message to the user in the web interface regardless of the contents of the
 sent e-mail and whether or not this e-mail address was already registered.</p>
@@ -8983,7 +8990,7 @@ <h2 class="heading settled" data-level="15" id="sctn-accessiblility-consideratio
    <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥⑤">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③④③">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑥">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap" title="Client to Authenticator Protocol (CTAP)">[FIDO-CTAP]</a>.</p>
    <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③①">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
    <h3 class="heading settled" data-level="15.1" id="sctn-timeout-recommended-range"><span class="secno">15.1. </span><span class="content">Recommended Range for Ceremony Timeouts</span><a class="self-link" href="#sctn-timeout-recommended-range"></a></h3>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑥">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑨">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⑦">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤④">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑧">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④③②">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21" title="Web Content Accessibility Guidelines (WCAG) 2.1">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑨">client platform</a> MAY adjust the timeout accordingly.</p>
    <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="recommended-range-and-default-for-a-webauthn-ceremony-timeout">recommended range and default for a WebAuthn ceremony timeout</dfn> is as follows:</p>
    <ul>
     <li data-md>
@@ -11243,10 +11250,10 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "authdata-attestedcredentialdata-credentialidlength": {"dfnID":"authdata-attestedcredentialdata-credentialidlength","dfnText":"credentialIdLength","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialidlength"},{"id":"ref-for-authdata-attestedcredentialdata-credentialidlength\u2460"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-attestedcredentialdata-credentialidlength"},
 "authdata-attestedcredentialdata-credentialpublickey": {"dfnID":"authdata-attestedcredentialdata-credentialpublickey","dfnText":"credentialPublicKey","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2460"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2461"},{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2463"}],"title":"6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2465"}],"title":"8.2. Packed Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2466"}],"title":"8.3. TPM Attestation Statement Format"},{"refs":[{"id":"ref-for-authdata-attestedcredentialdata-credentialpublickey\u2467"}],"title":"8.4. Android Key Attestation Statement Format"}],"url":"#authdata-attestedcredentialdata-credentialpublickey"},
 "authdata-extensions": {"dfnID":"authdata-extensions","dfnText":"extensions","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-extensions"},{"id":"ref-for-authdata-extensions\u2460"},{"id":"ref-for-authdata-extensions\u2461"},{"id":"ref-for-authdata-extensions\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-extensions\u2463"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-extensions\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-authdata-extensions\u2465"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-authdata-extensions\u2466"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-extensions\u2467"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-extensions\u2468"},{"id":"ref-for-authdata-extensions\u2460\u24ea"}],"title":"9.5. Authenticator Extension Processing"}],"url":"#authdata-extensions"},
-"authdata-flags": {"dfnID":"authdata-flags","dfnText":"flags","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags"},{"id":"ref-for-authdata-flags\u2460"},{"id":"ref-for-authdata-flags\u2461"},{"id":"ref-for-authdata-flags\u2462"},{"id":"ref-for-authdata-flags\u2463"},{"id":"ref-for-authdata-flags\u2464"},{"id":"ref-for-authdata-flags\u2465"},{"id":"ref-for-authdata-flags\u2466"},{"id":"ref-for-authdata-flags\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags\u2468"},{"id":"ref-for-authdata-flags\u2460\u24ea"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-authdata-flags\u2460\u2460"},{"id":"ref-for-authdata-flags\u2460\u2461"},{"id":"ref-for-authdata-flags\u2460\u2462"},{"id":"ref-for-authdata-flags\u2460\u2463"},{"id":"ref-for-authdata-flags\u2460\u2464"},{"id":"ref-for-authdata-flags\u2460\u2465"},{"id":"ref-for-authdata-flags\u2460\u2466"},{"id":"ref-for-authdata-flags\u2460\u2467"},{"id":"ref-for-authdata-flags\u2460\u2468"},{"id":"ref-for-authdata-flags\u2461\u24ea"},{"id":"ref-for-authdata-flags\u2461\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2461"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2462"},{"id":"ref-for-authdata-flags\u2461\u2463"},{"id":"ref-for-authdata-flags\u2461\u2464"},{"id":"ref-for-authdata-flags\u2461\u2465"},{"id":"ref-for-authdata-flags\u2461\u2466"},{"id":"ref-for-authdata-flags\u2461\u2467"},{"id":"ref-for-authdata-flags\u2461\u2468"},{"id":"ref-for-authdata-flags\u2462\u24ea"},{"id":"ref-for-authdata-flags\u2462\u2460"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2461"},{"id":"ref-for-authdata-flags\u2462\u2462"},{"id":"ref-for-authdata-flags\u2462\u2463"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2464"},{"id":"ref-for-authdata-flags\u2462\u2465"},{"id":"ref-for-authdata-flags\u2462\u2466"},{"id":"ref-for-authdata-flags\u2462\u2467"},{"id":"ref-for-authdata-flags\u2462\u2468"},{"id":"ref-for-authdata-flags\u2463\u24ea"},{"id":"ref-for-authdata-flags\u2463\u2460"},{"id":"ref-for-authdata-flags\u2463\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2463\u2462"},{"id":"ref-for-authdata-flags\u2463\u2463"},{"id":"ref-for-authdata-flags\u2463\u2464"},{"id":"ref-for-authdata-flags\u2463\u2465"},{"id":"ref-for-authdata-flags\u2463\u2466"},{"id":"ref-for-authdata-flags\u2463\u2467"},{"id":"ref-for-authdata-flags\u2463\u2468"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u24ea"},{"id":"ref-for-authdata-flags\u2464\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2461"},{"id":"ref-for-authdata-flags\u2464\u2462"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#authdata-flags"},
+"authdata-flags": {"dfnID":"authdata-flags","dfnText":"flags","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags"},{"id":"ref-for-authdata-flags\u2460"},{"id":"ref-for-authdata-flags\u2461"},{"id":"ref-for-authdata-flags\u2462"},{"id":"ref-for-authdata-flags\u2463"},{"id":"ref-for-authdata-flags\u2464"},{"id":"ref-for-authdata-flags\u2465"},{"id":"ref-for-authdata-flags\u2466"},{"id":"ref-for-authdata-flags\u2467"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags\u2468"},{"id":"ref-for-authdata-flags\u2460\u24ea"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-authdata-flags\u2460\u2460"},{"id":"ref-for-authdata-flags\u2460\u2461"},{"id":"ref-for-authdata-flags\u2460\u2462"},{"id":"ref-for-authdata-flags\u2460\u2463"},{"id":"ref-for-authdata-flags\u2460\u2464"},{"id":"ref-for-authdata-flags\u2460\u2465"},{"id":"ref-for-authdata-flags\u2460\u2466"},{"id":"ref-for-authdata-flags\u2460\u2467"},{"id":"ref-for-authdata-flags\u2460\u2468"},{"id":"ref-for-authdata-flags\u2461\u24ea"},{"id":"ref-for-authdata-flags\u2461\u2460"},{"id":"ref-for-authdata-flags\u2461\u2461"},{"id":"ref-for-authdata-flags\u2461\u2462"},{"id":"ref-for-authdata-flags\u2461\u2463"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2464"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-flags\u2461\u2465"},{"id":"ref-for-authdata-flags\u2461\u2466"},{"id":"ref-for-authdata-flags\u2461\u2467"},{"id":"ref-for-authdata-flags\u2461\u2468"},{"id":"ref-for-authdata-flags\u2462\u24ea"},{"id":"ref-for-authdata-flags\u2462\u2460"},{"id":"ref-for-authdata-flags\u2462\u2461"},{"id":"ref-for-authdata-flags\u2462\u2462"},{"id":"ref-for-authdata-flags\u2462\u2463"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2464"},{"id":"ref-for-authdata-flags\u2462\u2465"},{"id":"ref-for-authdata-flags\u2462\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authdata-flags\u2462\u2467"},{"id":"ref-for-authdata-flags\u2462\u2468"},{"id":"ref-for-authdata-flags\u2463\u24ea"},{"id":"ref-for-authdata-flags\u2463\u2460"},{"id":"ref-for-authdata-flags\u2463\u2461"},{"id":"ref-for-authdata-flags\u2463\u2462"},{"id":"ref-for-authdata-flags\u2463\u2463"},{"id":"ref-for-authdata-flags\u2463\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2463\u2465"},{"id":"ref-for-authdata-flags\u2463\u2466"},{"id":"ref-for-authdata-flags\u2463\u2467"},{"id":"ref-for-authdata-flags\u2463\u2468"},{"id":"ref-for-authdata-flags\u2464\u24ea"},{"id":"ref-for-authdata-flags\u2464\u2460"},{"id":"ref-for-authdata-flags\u2464\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2462"},{"id":"ref-for-authdata-flags\u2464\u2463"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2464"},{"id":"ref-for-authdata-flags\u2464\u2465"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-authdata-flags\u2464\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#authdata-flags"},
 "authdata-flags-at": {"dfnID":"authdata-flags-at","dfnText":"AT","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-at"},{"id":"ref-for-authdata-flags-at\u2460"},{"id":"ref-for-authdata-flags-at\u2461"},{"id":"ref-for-authdata-flags-at\u2462"},{"id":"ref-for-authdata-flags-at\u2463"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-flags-at"},
-"authdata-flags-be": {"dfnID":"authdata-flags-be","dfnText":"BE","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-be"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460"},{"id":"ref-for-authdata-flags-be\u2461"},{"id":"ref-for-authdata-flags-be\u2462"},{"id":"ref-for-authdata-flags-be\u2463"},{"id":"ref-for-authdata-flags-be\u2464"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-be\u2465"},{"id":"ref-for-authdata-flags-be\u2466"},{"id":"ref-for-authdata-flags-be\u2467"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-be\u2468"},{"id":"ref-for-authdata-flags-be\u2460\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2460"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2461"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-be"},
-"authdata-flags-bs": {"dfnID":"authdata-flags-bs","dfnText":"BS","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-bs"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460"},{"id":"ref-for-authdata-flags-bs\u2461"},{"id":"ref-for-authdata-flags-bs\u2462"},{"id":"ref-for-authdata-flags-bs\u2463"},{"id":"ref-for-authdata-flags-bs\u2464"},{"id":"ref-for-authdata-flags-bs\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2466"},{"id":"ref-for-authdata-flags-bs\u2467"},{"id":"ref-for-authdata-flags-bs\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u24ea"},{"id":"ref-for-authdata-flags-bs\u2460\u2460"},{"id":"ref-for-authdata-flags-bs\u2460\u2461"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2462"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2463"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-bs"},
+"authdata-flags-be": {"dfnID":"authdata-flags-be","dfnText":"BE","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-be"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-be\u2461"},{"id":"ref-for-authdata-flags-be\u2462"},{"id":"ref-for-authdata-flags-be\u2463"},{"id":"ref-for-authdata-flags-be\u2464"},{"id":"ref-for-authdata-flags-be\u2465"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-be\u2466"},{"id":"ref-for-authdata-flags-be\u2467"},{"id":"ref-for-authdata-flags-be\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u24ea"},{"id":"ref-for-authdata-flags-be\u2460\u2460"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2461"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-be\u2460\u2462"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-be"},
+"authdata-flags-bs": {"dfnID":"authdata-flags-bs","dfnText":"BS","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-bs"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460"},{"id":"ref-for-authdata-flags-bs\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2462"},{"id":"ref-for-authdata-flags-bs\u2463"},{"id":"ref-for-authdata-flags-bs\u2464"},{"id":"ref-for-authdata-flags-bs\u2465"},{"id":"ref-for-authdata-flags-bs\u2466"},{"id":"ref-for-authdata-flags-bs\u2467"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2468"},{"id":"ref-for-authdata-flags-bs\u2460\u24ea"},{"id":"ref-for-authdata-flags-bs\u2460\u2460"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2461"},{"id":"ref-for-authdata-flags-bs\u2460\u2462"},{"id":"ref-for-authdata-flags-bs\u2460\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-authdata-flags-bs\u2460\u2465"}],"title":"11.5. Add Credential"}],"url":"#authdata-flags-bs"},
 "authdata-flags-ed": {"dfnID":"authdata-flags-ed","dfnText":"ED","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-ed"},{"id":"ref-for-authdata-flags-ed\u2460"},{"id":"ref-for-authdata-flags-ed\u2461"}],"title":"6.1. Authenticator Data"}],"url":"#authdata-flags-ed"},
 "authdata-flags-up": {"dfnID":"authdata-flags-up","dfnText":"UP","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-up"},{"id":"ref-for-authdata-flags-up\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-up\u2461"}],"title":"6.1.2. FIDO U2F Signature Format Compatibility"},{"refs":[{"id":"ref-for-authdata-flags-up\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-up\u2463"}],"title":"7.2. Verifying an Authentication Assertion"}],"url":"#authdata-flags-up"},
 "authdata-flags-uv": {"dfnID":"authdata-flags-uv","dfnText":"UV","external":false,"refSections":[{"refs":[{"id":"ref-for-authdata-flags-uv"},{"id":"ref-for-authdata-flags-uv\u2460"},{"id":"ref-for-authdata-flags-uv\u2461"},{"id":"ref-for-authdata-flags-uv\u2462"},{"id":"ref-for-authdata-flags-uv\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2464"},{"id":"ref-for-authdata-flags-uv\u2465"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2466"},{"id":"ref-for-authdata-flags-uv\u2467"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2468"},{"id":"ref-for-authdata-flags-uv\u2460\u24ea"},{"id":"ref-for-authdata-flags-uv\u2460\u2460"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2460\u2461"},{"id":"ref-for-authdata-flags-uv\u2460\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2460\u2463"},{"id":"ref-for-authdata-flags-uv\u2460\u2464"},{"id":"ref-for-authdata-flags-uv\u2460\u2465"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-authdata-flags-uv\u2460\u2466"}],"title":"14.3. Authenticator-local Biometric Recognition"}],"url":"#authdata-flags-uv"},
@@ -11296,7 +11303,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "b85ee3be": {"dfnID":"b85ee3be","dfnText":"host","external":true,"refSections":[{"refs":[{"id":"ref-for-concept-url-host"}],"title":"3. Dependencies"},{"refs":[{"id":"ref-for-concept-url-host\u2460"},{"id":"ref-for-concept-url-host\u2461"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-concept-url-host\u2462"},{"id":"ref-for-concept-url-host\u2463"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"}],"url":"https://url.spec.whatwg.org/#concept-url-host"},
 "ba556545": {"dfnID":"ba556545","dfnText":"NotAllowedError","external":true,"refSections":[{"refs":[{"id":"ref-for-notallowederror"},{"id":"ref-for-notallowederror\u2460"},{"id":"ref-for-notallowederror\u2461"},{"id":"ref-for-notallowederror\u2462"},{"id":"ref-for-notallowederror\u2463"},{"id":"ref-for-notallowederror\u2464"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2465"}],"title":"5.1.3.1. Create Request Exceptions"},{"refs":[{"id":"ref-for-notallowederror\u2466"},{"id":"ref-for-notallowederror\u2467"},{"id":"ref-for-notallowederror\u2468"},{"id":"ref-for-notallowederror\u2460\u24ea"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2460"}],"title":"5.1.4.3. Get Request Exceptions"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2461"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2462"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2463"},{"id":"ref-for-notallowederror\u2460\u2464"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-notallowederror\u2460\u2465"},{"id":"ref-for-notallowederror\u2460\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"}],"url":"https://webidl.spec.whatwg.org/#notallowederror"},
 "ba9c2b34": {"dfnID":"ba9c2b34","dfnText":"single-factor","external":true,"refSections":[{"refs":[{"id":"ref-for-sf"}],"title":"6.2. Authenticator Taxonomy"}],"url":"https://pages.nist.gov/800-63-3/sp800-63-3.html#sf"},
-"backed-up": {"dfnID":"backed-up","dfnText":"Backed Up","external":false,"refSections":[{"refs":[{"id":"ref-for-backed-up"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backed-up\u2460"},{"id":"ref-for-backed-up\u2461"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backed-up\u2462"},{"id":"ref-for-backed-up\u2463"}],"title":"6.1.3. Credential Backup State"}],"url":"#backed-up"},
+"backed-up": {"dfnID":"backed-up","dfnText":"Backed Up","external":false,"refSections":[{"refs":[{"id":"ref-for-backed-up"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backed-up\u2460"},{"id":"ref-for-backed-up\u2461"},{"id":"ref-for-backed-up\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backed-up\u2463"},{"id":"ref-for-backed-up\u2464"}],"title":"6.1.3. Credential Backup State"}],"url":"#backed-up"},
 "backup-eligibility": {"dfnID":"backup-eligibility","dfnText":"Backup Eligibility","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-eligibility"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backup-eligibility\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backup-eligibility\u2461"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-backup-eligibility\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-backup-eligibility\u2463"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-backup-eligibility\u2464"},{"id":"ref-for-backup-eligibility\u2465"},{"id":"ref-for-backup-eligibility\u2466"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-backup-eligibility\u2467"},{"id":"ref-for-backup-eligibility\u2468"}],"title":"11.10. Set Credential Properties"}],"url":"#backup-eligibility"},
 "backup-eligible": {"dfnID":"backup-eligible","dfnText":"Backup Eligible","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-eligible"},{"id":"ref-for-backup-eligible\u2460"}],"title":"6.1. Authenticator Data"}],"url":"#backup-eligible"},
 "backup-state": {"dfnID":"backup-state","dfnText":"Backup State","external":false,"refSections":[{"refs":[{"id":"ref-for-backup-state"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-backup-state\u2460"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-backup-state\u2461"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-backup-state\u2462"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-backup-state\u2463"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-backup-state\u2464"}],"title":"11.2. Virtual Authenticators"},{"refs":[{"id":"ref-for-backup-state\u2465"},{"id":"ref-for-backup-state\u2466"},{"id":"ref-for-backup-state\u2467"}],"title":"11.5. Add Credential"},{"refs":[{"id":"ref-for-backup-state\u2468"},{"id":"ref-for-backup-state\u2460\u24ea"}],"title":"11.10. Set Credential Properties"}],"url":"#backup-state"},
@@ -11670,7 +11677,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "get-credentials": {"dfnID":"get-credentials","dfnText":"Get Credentials","external":false,"refSections":[{"refs":[{"id":"ref-for-get-credentials"}],"title":"11.6. Get Credentials"}],"url":"#get-credentials"},
 "human-palatability": {"dfnID":"human-palatability","dfnText":"Human Palatability","external":false,"refSections":[{"refs":[{"id":"ref-for-human-palatability"},{"id":"ref-for-human-palatability\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-human-palatability\u2461"},{"id":"ref-for-human-palatability\u2462"},{"id":"ref-for-human-palatability\u2463"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2464"},{"id":"ref-for-human-palatability\u2465"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-human-palatability\u2466"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#human-palatability"},
 "largeblob": {"dfnID":"largeblob","dfnText":"largeBlob","external":false,"refSections":[{"refs":[{"id":"ref-for-largeblob"},{"id":"ref-for-largeblob\u2460"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-largeblob\u2461"}],"title":"11.1.1. Authenticator Extension Capabilities"},{"refs":[{"id":"ref-for-largeblob\u2462"}],"title":"11.5. Add Credential"}],"url":"#largeblob"},
-"multi-device-credential": {"dfnID":"multi-device-credential","dfnText":"multi-device credential","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-device-credential"},{"id":"ref-for-multi-device-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-multi-device-credential\u2461"},{"id":"ref-for-multi-device-credential\u2462"},{"id":"ref-for-multi-device-credential\u2463"},{"id":"ref-for-multi-device-credential\u2464"}],"title":"6.1.3. Credential Backup State"}],"url":"#multi-device-credential"},
+"multi-device-credential": {"dfnID":"multi-device-credential","dfnText":"multi-device credential","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-device-credential"},{"id":"ref-for-multi-device-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-multi-device-credential\u2461"},{"id":"ref-for-multi-device-credential\u2462"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-multi-device-credential\u2463"},{"id":"ref-for-multi-device-credential\u2464"},{"id":"ref-for-multi-device-credential\u2465"},{"id":"ref-for-multi-device-credential\u2466"}],"title":"6.1.3. Credential Backup State"}],"url":"#multi-device-credential"},
 "multi-factor-capable": {"dfnID":"multi-factor-capable","dfnText":"multi-factor capable","external":false,"refSections":[{"refs":[{"id":"ref-for-multi-factor-capable"},{"id":"ref-for-multi-factor-capable\u2460"},{"id":"ref-for-multi-factor-capable\u2461"},{"id":"ref-for-multi-factor-capable\u2462"},{"id":"ref-for-multi-factor-capable\u2463"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-multi-factor-capable\u2464"},{"id":"ref-for-multi-factor-capable\u2465"}],"title":"6.2.3. Authentication Factor Capability"}],"url":"#multi-factor-capable"},
 "non-discoverable-credential": {"dfnID":"non-discoverable-credential","dfnText":"Non-Discoverable Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-non-discoverable-credential"},{"id":"ref-for-non-discoverable-credential\u2460"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2461"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2462"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-non-discoverable-credential\u2463"}],"title":"10.1.3. Credential Properties Extension (credProps)"}],"url":"#non-discoverable-credential"},
 "non-resident-credential": {"dfnID":"non-resident-credential","dfnText":"Non-Resident Credential","external":false,"refSections":[{"refs":[{"id":"ref-for-non-resident-credential"}],"title":"4. Terminology"}],"url":"#non-resident-credential"},
@@ -11699,7 +11706,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
 "recommended-range-and-default-for-a-webauthn-ceremony-timeout": {"dfnID":"recommended-range-and-default-for-a-webauthn-ceremony-timeout","dfnText":"recommended range and default for a WebAuthn ceremony timeout","external":false,"refSections":[{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2460"}],"title":"5.1.4.1. PublicKeyCredential\u2019s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-recommended-range-and-default-for-a-webauthn-ceremony-timeout\u2461"}],"title":"13.4.3. Cryptographic Challenges"}],"url":"#recommended-range-and-default-for-a-webauthn-ceremony-timeout"},
 "registrable-origin-label": {"dfnID":"registrable-origin-label","dfnText":"Registrable Origin Label","external":false,"refSections":[{"refs":[{"id":"ref-for-registrable-origin-label"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registrable-origin-label\u2460"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-registrable-origin-label\u2461"},{"id":"ref-for-registrable-origin-label\u2462"}],"title":"5.11.1. Validating Related Origins"}],"url":"#registrable-origin-label"},
 "registration": {"dfnID":"registration","dfnText":"Registration","external":false,"refSections":[{"refs":[{"id":"ref-for-registration"},{"id":"ref-for-registration\u2460"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-registration\u2461"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-registration\u2462"},{"id":"ref-for-registration\u2463"},{"id":"ref-for-registration\u2464"},{"id":"ref-for-registration\u2465"},{"id":"ref-for-registration\u2466"},{"id":"ref-for-registration\u2467"},{"id":"ref-for-registration\u2468"},{"id":"ref-for-registration\u2460\u24ea"},{"id":"ref-for-registration\u2460\u2460"},{"id":"ref-for-registration\u2460\u2461"},{"id":"ref-for-registration\u2460\u2462"},{"id":"ref-for-registration\u2460\u2463"},{"id":"ref-for-registration\u2460\u2464"},{"id":"ref-for-registration\u2460\u2465"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration\u2460\u2466"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-registration\u2460\u2467"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-registration\u2460\u2468"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration\u2461\u24ea"},{"id":"ref-for-registration\u2461\u2460"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration\u2461\u2461"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2462"},{"id":"ref-for-registration\u2461\u2463"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-registration\u2461\u2464"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-registration\u2461\u2465"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-registration\u2461\u2466"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-registration\u2461\u2467"}],"title":"16. Acknowledgements"}],"url":"#registration"},
-"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"},{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2464"},{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"},{"id":"ref-for-registration-ceremony\u2460\u2467"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2460"},{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2465"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
+"registration-ceremony": {"dfnID":"registration-ceremony","dfnText":"Registration Ceremony","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-ceremony"},{"id":"ref-for-registration-ceremony\u2460"},{"id":"ref-for-registration-ceremony\u2461"},{"id":"ref-for-registration-ceremony\u2462"},{"id":"ref-for-registration-ceremony\u2463"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-registration-ceremony\u2464"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-registration-ceremony\u2465"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-registration-ceremony\u2466"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-registration-ceremony\u2467"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-registration-ceremony\u2468"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2460"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2461"},{"id":"ref-for-registration-ceremony\u2460\u2462"},{"id":"ref-for-registration-ceremony\u2460\u2463"},{"id":"ref-for-registration-ceremony\u2460\u2464"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-registration-ceremony\u2460\u2465"},{"id":"ref-for-registration-ceremony\u2460\u2466"},{"id":"ref-for-registration-ceremony\u2460\u2467"},{"id":"ref-for-registration-ceremony\u2460\u2468"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u24ea"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2460"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2461"},{"id":"ref-for-registration-ceremony\u2461\u2462"},{"id":"ref-for-registration-ceremony\u2461\u2463"},{"id":"ref-for-registration-ceremony\u2461\u2464"},{"id":"ref-for-registration-ceremony\u2461\u2465"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-registration-ceremony\u2461\u2466"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#registration-ceremony"},
 "registration-extension": {"dfnID":"registration-extension","dfnText":"registration\nextension","external":false,"refSections":[{"refs":[{"id":"ref-for-registration-extension"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-registration-extension\u2460"}],"title":"5.7. WebAuthn Extensions Inputs and Outputs"},{"refs":[{"id":"ref-for-registration-extension\u2461"},{"id":"ref-for-registration-extension\u2462"},{"id":"ref-for-registration-extension\u2463"},{"id":"ref-for-registration-extension\u2464"},{"id":"ref-for-registration-extension\u2465"},{"id":"ref-for-registration-extension\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-registration-extension\u2467"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-registration-extension\u2468"},{"id":"ref-for-registration-extension\u2460\u24ea"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2460"},{"id":"ref-for-registration-extension\u2460\u2461"},{"id":"ref-for-registration-extension\u2460\u2462"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-registration-extension\u2460\u2463"},{"id":"ref-for-registration-extension\u2460\u2464"},{"id":"ref-for-registration-extension\u2460\u2465"},{"id":"ref-for-registration-extension\u2460\u2466"},{"id":"ref-for-registration-extension\u2460\u2467"},{"id":"ref-for-registration-extension\u2460\u2468"},{"id":"ref-for-registration-extension\u2461\u24ea"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-registration-extension\u2461\u2460"},{"id":"ref-for-registration-extension\u2461\u2461"}],"title":"12.4. WebAuthn Extension Identifier Registrations"}],"url":"#registration-extension"},
 "relying-party": {"dfnID":"relying-party","dfnText":"Relying Party","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party\u2460"},{"id":"ref-for-relying-party\u2461"},{"id":"ref-for-relying-party\u2462"},{"id":"ref-for-relying-party\u2463"},{"id":"ref-for-relying-party\u2464"},{"id":"ref-for-relying-party\u2465"},{"id":"ref-for-relying-party\u2466"}],"title":"1. Introduction"},{"refs":[{"id":"ref-for-relying-party\u2467"},{"id":"ref-for-relying-party\u2468"},{"id":"ref-for-relying-party\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460"},{"id":"ref-for-relying-party\u2460\u2461"},{"id":"ref-for-relying-party\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2463"},{"id":"ref-for-relying-party\u2460\u2464"}],"title":"1.1. Specification Roadmap"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465"}],"title":"1.2.3. New Device Registration"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466"}],"title":"1.2.4. Other Use Cases and Configurations"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2460"}],"title":"1.3.1. Registration"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2463"}],"title":"1.3.2. Registration Specifically with User-Verifying Platform Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2466"},{"id":"ref-for-relying-party\u2461\u2467"},{"id":"ref-for-relying-party\u2461\u2468"}],"title":"1.3.3. Authentication"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2460"}],"title":"1.3.5. Decommissioning"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461"}],"title":"2.1.1. Enumerations as DOMString types"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462"},{"id":"ref-for-relying-party\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2464"},{"id":"ref-for-relying-party\u2462\u2465"},{"id":"ref-for-relying-party\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2468"},{"id":"ref-for-relying-party\u2463\u24ea"},{"id":"ref-for-relying-party\u2463\u2460"},{"id":"ref-for-relying-party\u2463\u2461"},{"id":"ref-for-relying-party\u2463\u2462"},{"id":"ref-for-relying-party\u2463\u2463"},{"id":"ref-for-relying-party\u2463\u2464"},{"id":"ref-for-relying-party\u2463\u2465"},{"id":"ref-for-relying-party\u2463\u2466"},{"id":"ref-for-relying-party\u2463\u2467"},{"id":"ref-for-relying-party\u2463\u2468"},{"id":"ref-for-relying-party\u2464\u24ea"},{"id":"ref-for-relying-party\u2464\u2460"},{"id":"ref-for-relying-party\u2464\u2461"},{"id":"ref-for-relying-party\u2464\u2462"},{"id":"ref-for-relying-party\u2464\u2463"},{"id":"ref-for-relying-party\u2464\u2464"},{"id":"ref-for-relying-party\u2464\u2465"},{"id":"ref-for-relying-party\u2464\u2466"},{"id":"ref-for-relying-party\u2464\u2467"},{"id":"ref-for-relying-party\u2464\u2468"},{"id":"ref-for-relying-party\u2465\u24ea"},{"id":"ref-for-relying-party\u2465\u2460"},{"id":"ref-for-relying-party\u2465\u2461"},{"id":"ref-for-relying-party\u2465\u2462"},{"id":"ref-for-relying-party\u2465\u2463"},{"id":"ref-for-relying-party\u2465\u2464"},{"id":"ref-for-relying-party\u2465\u2465"},{"id":"ref-for-relying-party\u2465\u2466"},{"id":"ref-for-relying-party\u2465\u2467"},{"id":"ref-for-relying-party\u2465\u2468"},{"id":"ref-for-relying-party\u2466\u24ea"},{"id":"ref-for-relying-party\u2466\u2460"},{"id":"ref-for-relying-party\u2466\u2461"},{"id":"ref-for-relying-party\u2466\u2462"},{"id":"ref-for-relying-party\u2466\u2463"},{"id":"ref-for-relying-party\u2466\u2464"},{"id":"ref-for-relying-party\u2466\u2465"},{"id":"ref-for-relying-party\u2466\u2466"},{"id":"ref-for-relying-party\u2466\u2467"},{"id":"ref-for-relying-party\u2466\u2468"},{"id":"ref-for-relying-party\u2467\u24ea"},{"id":"ref-for-relying-party\u2467\u2460"},{"id":"ref-for-relying-party\u2467\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party\u2467\u2462"},{"id":"ref-for-relying-party\u2467\u2463"},{"id":"ref-for-relying-party\u2467\u2464"},{"id":"ref-for-relying-party\u2467\u2465"},{"id":"ref-for-relying-party\u2467\u2466"},{"id":"ref-for-relying-party\u2467\u2467"},{"id":"ref-for-relying-party\u2467\u2468"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party\u2468\u24ea"},{"id":"ref-for-relying-party\u2468\u2460"},{"id":"ref-for-relying-party\u2468\u2461"},{"id":"ref-for-relying-party\u2468\u2462"},{"id":"ref-for-relying-party\u2468\u2463"}],"title":"5.1. PublicKeyCredential Interface"},{"refs":[{"id":"ref-for-relying-party\u2468\u2464"},{"id":"ref-for-relying-party\u2468\u2465"},{"id":"ref-for-relying-party\u2468\u2466"},{"id":"ref-for-relying-party\u2468\u2467"},{"id":"ref-for-relying-party\u2468\u2468"},{"id":"ref-for-relying-party\u2460\u24ea\u24ea"}],"title":"5.1.3. Create a New Credential - PublicKeyCredential\u2019s [[Create]](origin, options, sameOriginWithAncestors) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2460"},{"id":"ref-for-relying-party\u2460\u24ea\u2461"},{"id":"ref-for-relying-party\u2460\u24ea\u2462"},{"id":"ref-for-relying-party\u2460\u24ea\u2463"}],"title":"5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential\u2019s [[Get]](options) Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2464"},{"id":"ref-for-relying-party\u2460\u24ea\u2465"}],"title":"5.1.4.2. Issuing a Credential Request to an Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2466"}],"title":"5.1.6. Availability of User-Verifying Platform Authenticator - PublicKeyCredential\u2019s isUserVerifyingPlatformAuthenticatorAvailable() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u24ea\u2467"},{"id":"ref-for-relying-party\u2460\u24ea\u2468"}],"title":"5.1.7. Availability of client capabilities - PublicKeyCredential\u2019s getClientCapabilities() Method"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u24ea"},{"id":"ref-for-relying-party\u2460\u2460\u2460"}],"title":"5.1.10.3. signalAllAcceptedCredentials(options)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2461"}],"title":"5.2. Authenticator Responses (interface AuthenticatorResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2462"},{"id":"ref-for-relying-party\u2460\u2460\u2463"}],"title":"5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2460\u2464"},{"id":"ref-for-relying-party\u2460\u2460\u2465"},{"id":"ref-for-relying-party\u2460\u2460\u2466"},{"id":"ref-for-relying-party\u2460\u2460\u2467"},{"id":"ref-for-relying-party\u2460\u2460\u2468"},{"id":"ref-for-relying-party\u2460\u2461\u24ea"},{"id":"ref-for-relying-party\u2460\u2461\u2460"}],"title":"5.2.1.1. Easily accessing credential data"},{"refs":[{"id":"ref-for-relying-party\u2460\u2461\u2461"},{"id":"ref-for-relying-party\u2460\u2461\u2462"},{"id":"ref-for-relying-party\u2460\u2461\u2463"},{"id":"ref-for-relying-party\u2460\u2461\u2464"},{"id":"ref-for-relying-party\u2460\u2461\u2465"},{"id":"ref-for-relying-party\u2460\u2461\u2466"},{"id":"ref-for-relying-party\u2460\u2461\u2467"},{"id":"ref-for-relying-party\u2460\u2461\u2468"},{"id":"ref-for-relying-party\u2460\u2462\u24ea"},{"id":"ref-for-relying-party\u2460\u2462\u2460"},{"id":"ref-for-relying-party\u2460\u2462\u2461"}],"title":"5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2462"},{"id":"ref-for-relying-party\u2460\u2462\u2463"},{"id":"ref-for-relying-party\u2460\u2462\u2464"},{"id":"ref-for-relying-party\u2460\u2462\u2465"},{"id":"ref-for-relying-party\u2460\u2462\u2466"},{"id":"ref-for-relying-party\u2460\u2462\u2467"}],"title":"5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2462\u2468"},{"id":"ref-for-relying-party\u2460\u2463\u24ea"}],"title":"5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2460"},{"id":"ref-for-relying-party\u2460\u2463\u2461"},{"id":"ref-for-relying-party\u2460\u2463\u2462"},{"id":"ref-for-relying-party\u2460\u2463\u2463"},{"id":"ref-for-relying-party\u2460\u2463\u2464"}],"title":"5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2465"},{"id":"ref-for-relying-party\u2460\u2463\u2466"},{"id":"ref-for-relying-party\u2460\u2463\u2467"}],"title":"5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2463\u2468"},{"id":"ref-for-relying-party\u2460\u2464\u24ea"},{"id":"ref-for-relying-party\u2460\u2464\u2460"}],"title":"5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2461"},{"id":"ref-for-relying-party\u2460\u2464\u2462"},{"id":"ref-for-relying-party\u2460\u2464\u2463"},{"id":"ref-for-relying-party\u2460\u2464\u2464"},{"id":"ref-for-relying-party\u2460\u2464\u2465"},{"id":"ref-for-relying-party\u2460\u2464\u2466"}],"title":"5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2464\u2467"},{"id":"ref-for-relying-party\u2460\u2464\u2468"},{"id":"ref-for-relying-party\u2460\u2465\u24ea"},{"id":"ref-for-relying-party\u2460\u2465\u2460"},{"id":"ref-for-relying-party\u2460\u2465\u2461"},{"id":"ref-for-relying-party\u2460\u2465\u2462"},{"id":"ref-for-relying-party\u2460\u2465\u2463"},{"id":"ref-for-relying-party\u2460\u2465\u2464"}],"title":"5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2465\u2465"},{"id":"ref-for-relying-party\u2460\u2465\u2466"},{"id":"ref-for-relying-party\u2460\u2465\u2467"},{"id":"ref-for-relying-party\u2460\u2465\u2468"},{"id":"ref-for-relying-party\u2460\u2466\u24ea"},{"id":"ref-for-relying-party\u2460\u2466\u2460"},{"id":"ref-for-relying-party\u2460\u2466\u2461"},{"id":"ref-for-relying-party\u2460\u2466\u2462"},{"id":"ref-for-relying-party\u2460\u2466\u2463"}],"title":"5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2464"}],"title":"5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2466\u2465"},{"id":"ref-for-relying-party\u2460\u2466\u2466"},{"id":"ref-for-relying-party\u2460\u2466\u2467"},{"id":"ref-for-relying-party\u2460\u2466\u2468"},{"id":"ref-for-relying-party\u2460\u2467\u24ea"}],"title":"5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2460"}],"title":"5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2461"},{"id":"ref-for-relying-party\u2460\u2467\u2462"},{"id":"ref-for-relying-party\u2460\u2467\u2463"}],"title":"5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2464"}],"title":"5.8.7. Client Capability Enumeration (enum ClientCapability)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2467\u2465"},{"id":"ref-for-relying-party\u2460\u2467\u2466"},{"id":"ref-for-relying-party\u2460\u2467\u2467"},{"id":"ref-for-relying-party\u2460\u2467\u2468"},{"id":"ref-for-relying-party\u2460\u2468\u24ea"},{"id":"ref-for-relying-party\u2460\u2468\u2460"},{"id":"ref-for-relying-party\u2460\u2468\u2461"}],"title":"5.8.8. User-agent Hints Enumeration (enum PublicKeyCredentialHints)"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2462"}],"title":"5.10. Using Web Authentication within iframe elements"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2463"}],"title":"5.11. Using Web Authentication across related origins"},{"refs":[{"id":"ref-for-relying-party\u2460\u2468\u2464"},{"id":"ref-for-relying-party\u2460\u2468\u2465"},{"id":"ref-for-relying-party\u2460\u2468\u2466"},{"id":"ref-for-relying-party\u2460\u2468\u2467"},{"id":"ref-for-relying-party\u2460\u2468\u2468"}],"title":"6. WebAuthn Authenticator Model"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u24ea"}],"title":"6.1. Authenticator Data"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2460"},{"id":"ref-for-relying-party\u2461\u24ea\u2461"},{"id":"ref-for-relying-party\u2461\u24ea\u2462"},{"id":"ref-for-relying-party\u2461\u24ea\u2463"},{"id":"ref-for-relying-party\u2461\u24ea\u2464"}],"title":"6.1.1. Signature Counter Considerations"},{"refs":[{"id":"ref-for-relying-party\u2461\u24ea\u2465"},{"id":"ref-for-relying-party\u2461\u24ea\u2466"},{"id":"ref-for-relying-party\u2461\u24ea\u2467"},{"id":"ref-for-relying-party\u2461\u24ea\u2468"},{"id":"ref-for-relying-party\u2461\u2460\u24ea"}],"title":"6.1.3. Credential Backup State"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2460"}],"title":"6.2. Authenticator Taxonomy"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2461"},{"id":"ref-for-relying-party\u2461\u2460\u2462"},{"id":"ref-for-relying-party\u2461\u2460\u2463"}],"title":"6.2.2. Credential Storage Modality"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2464"},{"id":"ref-for-relying-party\u2461\u2460\u2465"},{"id":"ref-for-relying-party\u2461\u2460\u2466"}],"title":"6.2.3. Authentication Factor Capability"},{"refs":[{"id":"ref-for-relying-party\u2461\u2460\u2467"},{"id":"ref-for-relying-party\u2461\u2460\u2468"},{"id":"ref-for-relying-party\u2461\u2461\u24ea"},{"id":"ref-for-relying-party\u2461\u2461\u2460"},{"id":"ref-for-relying-party\u2461\u2461\u2461"},{"id":"ref-for-relying-party\u2461\u2461\u2462"},{"id":"ref-for-relying-party\u2461\u2461\u2463"}],"title":"6.3.2. The authenticatorMakeCredential Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2464"},{"id":"ref-for-relying-party\u2461\u2461\u2465"},{"id":"ref-for-relying-party\u2461\u2461\u2466"}],"title":"6.3.3. The authenticatorGetAssertion Operation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2467"}],"title":"6.4. String Handling"},{"refs":[{"id":"ref-for-relying-party\u2461\u2461\u2468"}],"title":"6.4.1.1. String Truncation by Clients"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u24ea"},{"id":"ref-for-relying-party\u2461\u2462\u2460"},{"id":"ref-for-relying-party\u2461\u2462\u2461"},{"id":"ref-for-relying-party\u2461\u2462\u2462"},{"id":"ref-for-relying-party\u2461\u2462\u2463"},{"id":"ref-for-relying-party\u2461\u2462\u2464"},{"id":"ref-for-relying-party\u2461\u2462\u2465"},{"id":"ref-for-relying-party\u2461\u2462\u2466"}],"title":"6.5. Attestation"},{"refs":[{"id":"ref-for-relying-party\u2461\u2462\u2467"},{"id":"ref-for-relying-party\u2461\u2462\u2468"},{"id":"ref-for-relying-party\u2461\u2463\u24ea"},{"id":"ref-for-relying-party\u2461\u2463\u2460"},{"id":"ref-for-relying-party\u2461\u2463\u2461"}],"title":"6.5.3. Attestation Types"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2462"},{"id":"ref-for-relying-party\u2461\u2463\u2463"},{"id":"ref-for-relying-party\u2461\u2463\u2464"},{"id":"ref-for-relying-party\u2461\u2463\u2465"}],"title":"7. WebAuthn Relying Party Operations"},{"refs":[{"id":"ref-for-relying-party\u2461\u2463\u2466"},{"id":"ref-for-relying-party\u2461\u2463\u2467"},{"id":"ref-for-relying-party\u2461\u2463\u2468"},{"id":"ref-for-relying-party\u2461\u2464\u24ea"},{"id":"ref-for-relying-party\u2461\u2464\u2460"},{"id":"ref-for-relying-party\u2461\u2464\u2461"},{"id":"ref-for-relying-party\u2461\u2464\u2462"},{"id":"ref-for-relying-party\u2461\u2464\u2463"},{"id":"ref-for-relying-party\u2461\u2464\u2464"},{"id":"ref-for-relying-party\u2461\u2464\u2465"},{"id":"ref-for-relying-party\u2461\u2464\u2466"},{"id":"ref-for-relying-party\u2461\u2464\u2467"},{"id":"ref-for-relying-party\u2461\u2464\u2468"},{"id":"ref-for-relying-party\u2461\u2465\u24ea"},{"id":"ref-for-relying-party\u2461\u2465\u2460"},{"id":"ref-for-relying-party\u2461\u2465\u2461"},{"id":"ref-for-relying-party\u2461\u2465\u2462"},{"id":"ref-for-relying-party\u2461\u2465\u2463"},{"id":"ref-for-relying-party\u2461\u2465\u2464"},{"id":"ref-for-relying-party\u2461\u2465\u2465"},{"id":"ref-for-relying-party\u2461\u2465\u2466"},{"id":"ref-for-relying-party\u2461\u2465\u2467"},{"id":"ref-for-relying-party\u2461\u2465\u2468"},{"id":"ref-for-relying-party\u2461\u2466\u24ea"},{"id":"ref-for-relying-party\u2461\u2466\u2460"},{"id":"ref-for-relying-party\u2461\u2466\u2461"}],"title":"7.1. Registering a New Credential"},{"refs":[{"id":"ref-for-relying-party\u2461\u2466\u2462"},{"id":"ref-for-relying-party\u2461\u2466\u2463"},{"id":"ref-for-relying-party\u2461\u2466\u2464"},{"id":"ref-for-relying-party\u2461\u2466\u2465"},{"id":"ref-for-relying-party\u2461\u2466\u2466"},{"id":"ref-for-relying-party\u2461\u2466\u2467"},{"id":"ref-for-relying-party\u2461\u2466\u2468"},{"id":"ref-for-relying-party\u2461\u2467\u24ea"},{"id":"ref-for-relying-party\u2461\u2467\u2460"},{"id":"ref-for-relying-party\u2461\u2467\u2461"},{"id":"ref-for-relying-party\u2461\u2467\u2462"},{"id":"ref-for-relying-party\u2461\u2467\u2463"},{"id":"ref-for-relying-party\u2461\u2467\u2464"},{"id":"ref-for-relying-party\u2461\u2467\u2465"},{"id":"ref-for-relying-party\u2461\u2467\u2466"},{"id":"ref-for-relying-party\u2461\u2467\u2467"},{"id":"ref-for-relying-party\u2461\u2467\u2468"},{"id":"ref-for-relying-party\u2461\u2468\u24ea"}],"title":"7.2. Verifying an Authentication Assertion"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2460"},{"id":"ref-for-relying-party\u2461\u2468\u2461"}],"title":"8.2.1. Packed Attestation Statement Certificate Requirements"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2462"},{"id":"ref-for-relying-party\u2461\u2468\u2463"}],"title":"8.9. Compound Attestation Statement Format"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2464"},{"id":"ref-for-relying-party\u2461\u2468\u2465"},{"id":"ref-for-relying-party\u2461\u2468\u2466"}],"title":"9. WebAuthn Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2467"}],"title":"9.2. Defining Extensions"},{"refs":[{"id":"ref-for-relying-party\u2461\u2468\u2468"},{"id":"ref-for-relying-party\u2462\u24ea\u24ea"},{"id":"ref-for-relying-party\u2462\u24ea\u2460"}],"title":"9.3. Extending Request Parameters"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2461"}],"title":"9.5. Authenticator Extension Processing"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2462"},{"id":"ref-for-relying-party\u2462\u24ea\u2463"},{"id":"ref-for-relying-party\u2462\u24ea\u2464"},{"id":"ref-for-relying-party\u2462\u24ea\u2465"},{"id":"ref-for-relying-party\u2462\u24ea\u2466"}],"title":"10.1.1. FIDO AppID Extension (appid)"},{"refs":[{"id":"ref-for-relying-party\u2462\u24ea\u2467"},{"id":"ref-for-relying-party\u2462\u24ea\u2468"}],"title":"10.1.2. FIDO AppID Exclusion Extension (appidExclude)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u24ea"},{"id":"ref-for-relying-party\u2462\u2460\u2460"},{"id":"ref-for-relying-party\u2462\u2460\u2461"},{"id":"ref-for-relying-party\u2462\u2460\u2462"},{"id":"ref-for-relying-party\u2462\u2460\u2463"},{"id":"ref-for-relying-party\u2462\u2460\u2464"}],"title":"10.1.3. Credential Properties Extension (credProps)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2465"},{"id":"ref-for-relying-party\u2462\u2460\u2466"},{"id":"ref-for-relying-party\u2462\u2460\u2467"}],"title":"10.1.4. Pseudo-random function extension (prf)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2460\u2468"},{"id":"ref-for-relying-party\u2462\u2461\u24ea"},{"id":"ref-for-relying-party\u2462\u2461\u2460"},{"id":"ref-for-relying-party\u2462\u2461\u2461"},{"id":"ref-for-relying-party\u2462\u2461\u2462"},{"id":"ref-for-relying-party\u2462\u2461\u2463"},{"id":"ref-for-relying-party\u2462\u2461\u2464"},{"id":"ref-for-relying-party\u2462\u2461\u2465"}],"title":"10.1.5. Large blob storage extension (largeBlob)"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2466"}],"title":"12.4. WebAuthn Extension Identifier Registrations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2461\u2467"},{"id":"ref-for-relying-party\u2462\u2461\u2468"},{"id":"ref-for-relying-party\u2462\u2462\u24ea"},{"id":"ref-for-relying-party\u2462\u2462\u2460"}],"title":"13. Security Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2461"},{"id":"ref-for-relying-party\u2462\u2462\u2462"}],"title":"13.2. Physical Proximity between Client and Authenticator"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2463"},{"id":"ref-for-relying-party\u2462\u2462\u2464"}],"title":"13.3.2. Attestation Certificate and Attestation Certificate CA Compromise"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2465"}],"title":"13.4. Security considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2462\u2466"},{"id":"ref-for-relying-party\u2462\u2462\u2467"},{"id":"ref-for-relying-party\u2462\u2462\u2468"},{"id":"ref-for-relying-party\u2462\u2463\u24ea"},{"id":"ref-for-relying-party\u2462\u2463\u2460"},{"id":"ref-for-relying-party\u2462\u2463\u2461"}],"title":"13.4.1. Security Benefits for WebAuthn Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2462"},{"id":"ref-for-relying-party\u2462\u2463\u2463"},{"id":"ref-for-relying-party\u2462\u2463\u2464"},{"id":"ref-for-relying-party\u2462\u2463\u2465"}],"title":"13.4.2. Visibility Considerations for Embedded Usage"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2466"},{"id":"ref-for-relying-party\u2462\u2463\u2467"}],"title":"13.4.3. Cryptographic Challenges"},{"refs":[{"id":"ref-for-relying-party\u2462\u2463\u2468"},{"id":"ref-for-relying-party\u2462\u2464\u24ea"},{"id":"ref-for-relying-party\u2462\u2464\u2460"},{"id":"ref-for-relying-party\u2462\u2464\u2461"},{"id":"ref-for-relying-party\u2462\u2464\u2462"},{"id":"ref-for-relying-party\u2462\u2464\u2463"},{"id":"ref-for-relying-party\u2462\u2464\u2464"},{"id":"ref-for-relying-party\u2462\u2464\u2465"}],"title":"13.4.4. Attestation Limitations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2464\u2466"},{"id":"ref-for-relying-party\u2462\u2464\u2467"},{"id":"ref-for-relying-party\u2462\u2464\u2468"}],"title":"13.4.5. Revoked Attestation Certificates"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u24ea"},{"id":"ref-for-relying-party\u2462\u2465\u2460"},{"id":"ref-for-relying-party\u2462\u2465\u2461"}],"title":"13.4.6. Credential Loss and Key Mobility"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2462"},{"id":"ref-for-relying-party\u2462\u2465\u2463"}],"title":"13.4.7. Unprotected account detection"},{"refs":[{"id":"ref-for-relying-party\u2462\u2465\u2464"},{"id":"ref-for-relying-party\u2462\u2465\u2465"},{"id":"ref-for-relying-party\u2462\u2465\u2466"},{"id":"ref-for-relying-party\u2462\u2465\u2467"},{"id":"ref-for-relying-party\u2462\u2465\u2468"},{"id":"ref-for-relying-party\u2462\u2466\u24ea"},{"id":"ref-for-relying-party\u2462\u2466\u2460"},{"id":"ref-for-relying-party\u2462\u2466\u2461"},{"id":"ref-for-relying-party\u2462\u2466\u2462"}],"title":"13.4.8. Code injection attacks"},{"refs":[{"id":"ref-for-relying-party\u2462\u2466\u2463"},{"id":"ref-for-relying-party\u2462\u2466\u2464"},{"id":"ref-for-relying-party\u2462\u2466\u2465"},{"id":"ref-for-relying-party\u2462\u2466\u2466"},{"id":"ref-for-relying-party\u2462\u2466\u2467"},{"id":"ref-for-relying-party\u2462\u2466\u2468"},{"id":"ref-for-relying-party\u2462\u2467\u24ea"}],"title":"13.4.9. Validating the origin of a credential"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2460"}],"title":"14. Privacy Considerations"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2461"},{"id":"ref-for-relying-party\u2462\u2467\u2462"},{"id":"ref-for-relying-party\u2462\u2467\u2463"},{"id":"ref-for-relying-party\u2462\u2467\u2464"},{"id":"ref-for-relying-party\u2462\u2467\u2465"},{"id":"ref-for-relying-party\u2462\u2467\u2466"},{"id":"ref-for-relying-party\u2462\u2467\u2467"}],"title":"14.1. De-anonymization Prevention Measures"},{"refs":[{"id":"ref-for-relying-party\u2462\u2467\u2468"},{"id":"ref-for-relying-party\u2462\u2468\u24ea"},{"id":"ref-for-relying-party\u2462\u2468\u2460"},{"id":"ref-for-relying-party\u2462\u2468\u2461"},{"id":"ref-for-relying-party\u2462\u2468\u2462"},{"id":"ref-for-relying-party\u2462\u2468\u2463"},{"id":"ref-for-relying-party\u2462\u2468\u2464"},{"id":"ref-for-relying-party\u2462\u2468\u2465"},{"id":"ref-for-relying-party\u2462\u2468\u2466"},{"id":"ref-for-relying-party\u2462\u2468\u2467"},{"id":"ref-for-relying-party\u2462\u2468\u2468"}],"title":"14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u24ea"},{"id":"ref-for-relying-party\u2463\u24ea\u2460"},{"id":"ref-for-relying-party\u2463\u24ea\u2461"},{"id":"ref-for-relying-party\u2463\u24ea\u2462"},{"id":"ref-for-relying-party\u2463\u24ea\u2463"}],"title":"14.3. Authenticator-local Biometric Recognition"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2464"},{"id":"ref-for-relying-party\u2463\u24ea\u2465"},{"id":"ref-for-relying-party\u2463\u24ea\u2466"}],"title":"14.5.1. Registration Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u24ea\u2467"},{"id":"ref-for-relying-party\u2463\u24ea\u2468"},{"id":"ref-for-relying-party\u2463\u2460\u24ea"}],"title":"14.5.2. Authentication Ceremony Privacy"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2460"}],"title":"14.6. Privacy considerations for Relying Parties"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2461"},{"id":"ref-for-relying-party\u2463\u2460\u2462"}],"title":"14.6.1. User Handle Contents"},{"refs":[{"id":"ref-for-relying-party\u2463\u2460\u2463"},{"id":"ref-for-relying-party\u2463\u2460\u2464"},{"id":"ref-for-relying-party\u2463\u2460\u2465"},{"id":"ref-for-relying-party\u2463\u2460\u2466"},{"id":"ref-for-relying-party\u2463\u2460\u2467"},{"id":"ref-for-relying-party\u2463\u2460\u2468"},{"id":"ref-for-relying-party\u2463\u2461\u24ea"},{"id":"ref-for-relying-party\u2463\u2461\u2460"},{"id":"ref-for-relying-party\u2463\u2461\u2461"},{"id":"ref-for-relying-party\u2463\u2461\u2462"},{"id":"ref-for-relying-party\u2463\u2461\u2463"},{"id":"ref-for-relying-party\u2463\u2461\u2464"}],"title":"14.6.2. Username Enumeration"},{"refs":[{"id":"ref-for-relying-party\u2463\u2461\u2465"},{"id":"ref-for-relying-party\u2463\u2461\u2466"},{"id":"ref-for-relying-party\u2463\u2461\u2467"},{"id":"ref-for-relying-party\u2463\u2461\u2468"},{"id":"ref-for-relying-party\u2463\u2462\u24ea"}],"title":"14.6.3. Privacy leak via credential IDs"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2460"}],"title":"15. Accessibility Considerations"},{"refs":[{"id":"ref-for-relying-party\u2463\u2462\u2461"}],"title":"15.1. Recommended Range for Ceremony Timeouts"}],"url":"#relying-party"},
 "relying-party-identifier": {"dfnID":"relying-party-identifier","dfnText":"Relying Party Identifier","external":false,"refSections":[{"refs":[{"id":"ref-for-relying-party-identifier"},{"id":"ref-for-relying-party-identifier\u2460"},{"id":"ref-for-relying-party-identifier\u2461"}],"title":"4. Terminology"},{"refs":[{"id":"ref-for-relying-party-identifier\u2462"}],"title":"5. Web Authentication API"},{"refs":[{"id":"ref-for-relying-party-identifier\u2463"}],"title":"6.3.5. The silentCredentialDiscovery operation"}],"url":"#relying-party-identifier"},