diff --git a/index.bs b/index.bs
index 0ef70503c..39264911f 100644
--- a/index.bs
+++ b/index.bs
@@ -1187,7 +1187,7 @@ BCP 14 [[!RFC2119]] [[!RFC8174]] when, and only when, they appear in all capital
The [=credProps|Credential Properties Extension=] defines the [=credential property=]
{{CredentialPropertiesOutput/authenticatorDisplayName}}
which, when available, MAY be offered as a default for this value.
- The [=[RP]=] MAY also derive a default value from the authenticator's [=attestation statement=], if any.
+ The [=[RP]=] MAY alternatively derive a default value from the authenticator's [=attestation statement=], if any.
[=WebAuthn extensions=] MAY define additional [=struct/items=] needed to process the extension.
@@ -6076,6 +6076,14 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
: [$credential record/attestationClientDataJSON$]
:: |response|.{{AuthenticatorResponse/clientDataJSON}}
.
+
+ : [$credential record/authenticatorDisplayName$]
+ :: A [=human-palatable=] description of the [=public key credential source=].
+ This SHOULD be chosen by the user.
+
+ If |clientExtensionResults|.{{AuthenticationExtensionsClientOutputs/credProps}}.{{CredentialPropertiesOutput/authenticatorDisplayName}}
is present,
+ then its value MAY be offered as a default for this value.
+ The [=[RP]=] MAY alternatively derive a default value from the authenticator's [=attestation statement=], if any.
@@ -6260,6 +6268,11 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
update it to the value of the [=authData/flags/UV=] bit in the [=flags=] in |authData|.
This change SHOULD require authorization by an additional [=authentication factor=] equivalent to WebAuthn [=user verification=];
if not authorized, skip this step.
+ 1. If |credentialRecord|.[$credential record/authenticatorDisplayName$]
is used,
+ and |clientExtensionResults|.{{AuthenticationExtensionsClientOutputs/credProps}}.{{CredentialPropertiesOutput/authenticatorDisplayName}}
+ is present and not equal to |credentialRecord|.[$credential record/authenticatorDisplayName$]
,
+ then OPTIONALLY offer the user to update |credentialRecord|.[$credential record/authenticatorDisplayName$]
+ to the value of |clientExtensionResults|.{{AuthenticationExtensionsClientOutputs/credProps}}.{{CredentialPropertiesOutput/authenticatorDisplayName}}
.
If the [=[RP]=] performs additional security checks beyond these WebAuthn [=authentication ceremony=] steps,
the above state updates SHOULD be deferred to after those additional checks are completed successfully.