diff --git a/index.bs b/index.bs index 0ef70503c..39264911f 100644 --- a/index.bs +++ b/index.bs @@ -1187,7 +1187,7 @@ BCP 14 [[!RFC2119]] [[!RFC8174]] when, and only when, they appear in all capital The [=credProps|Credential Properties Extension=] defines the [=credential property=] {{CredentialPropertiesOutput/authenticatorDisplayName}} which, when available, MAY be offered as a default for this value. - The [=[RP]=] MAY also derive a default value from the authenticator's [=attestation statement=], if any. + The [=[RP]=] MAY alternatively derive a default value from the authenticator's [=attestation statement=], if any. [=WebAuthn extensions=] MAY define additional [=struct/items=] needed to process the extension. @@ -6076,6 +6076,14 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o : [$credential record/attestationClientDataJSON$] :: |response|.{{AuthenticatorResponse/clientDataJSON}}. + + : [$credential record/authenticatorDisplayName$] + :: A [=human-palatable=] description of the [=public key credential source=]. + This SHOULD be chosen by the user. + + If |clientExtensionResults|.{{AuthenticationExtensionsClientOutputs/credProps}}.{{CredentialPropertiesOutput/authenticatorDisplayName}} is present, + then its value MAY be offered as a default for this value. + The [=[RP]=] MAY alternatively derive a default value from the authenticator's [=attestation statement=], if any. @@ -6260,6 +6268,11 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o update it to the value of the [=authData/flags/UV=] bit in the [=flags=] in |authData|. This change SHOULD require authorization by an additional [=authentication factor=] equivalent to WebAuthn [=user verification=]; if not authorized, skip this step. + 1. If |credentialRecord|.[$credential record/authenticatorDisplayName$] is used, + and |clientExtensionResults|.{{AuthenticationExtensionsClientOutputs/credProps}}.{{CredentialPropertiesOutput/authenticatorDisplayName}} + is present and not equal to |credentialRecord|.[$credential record/authenticatorDisplayName$], + then OPTIONALLY offer the user to update |credentialRecord|.[$credential record/authenticatorDisplayName$] + to the value of |clientExtensionResults|.{{AuthenticationExtensionsClientOutputs/credProps}}.{{CredentialPropertiesOutput/authenticatorDisplayName}}. If the [=[RP]=] performs additional security checks beyond these WebAuthn [=authentication ceremony=] steps, the above state updates SHOULD be deferred to after those additional checks are completed successfully.