Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

PR Request for Web Authentication:
 An API for accessing Public Key Credentials 
Level 2 #315

Closed
YubicoDemo opened this issue Feb 17, 2021 · 8 comments
Closed

PR Request for Web Authentication:
 An API for accessing Public Key Credentials 
Level 2 #315

YubicoDemo opened this issue Feb 17, 2021 · 8 comments
Assignees
@wseltzer
Labels
Awaiting Publication Approved by the Director, waiting on publication Entering PR Proposed Recommendation

Comments

@YubicoDemo
Copy link

YubicoDemo commented Feb 17, 2021 •
edited by wseltzer
Loading

Document title, URLs, estimated publication date

Web Authentication: An API for Accessing Public Key Credentials Level 2
https://www.w3.org/TR/webauthn-2/
Estimated pub-date: 19 02 2021
Staged: https://www.w3.org/TR/2021/PR-webauthn-2-20210225/

Abstract

This specification defines an API enabling the creation and use of strong, attested, scoped, public key-based credentials by web applications, for the purpose of strongly authenticating users. Conceptually, one or more public key credentials, each scoped to a given WebAuthn Relying Party, are created by and bound to authenticators as requested by the web application. The user agent mediates access to authenticators and their public key credentials in order to preserve user privacy. Authenticators are responsible for ensuring that no operation is performed without user consent. Authenticators provide cryptographic proof of their properties to Relying Parties via attestation. This specification also describes the functional model for WebAuthn conformant authenticators, including their signature and attestation functionality.

Status

CR

Link to group's decision to request transition

https://www.w3.org/2021/01/27-webauthn-minutes.html

Changes

since CR, all editorial:

  • Updated a superseded reference (CBOR, RFC 7049->8949)
  • Removed an empty section, which caused some internal reference renumbering
  • Updated non-normative example code
  • Added a non-normative accessibility considerations section
  • Updated editors listing

https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2Fwebauthn-2%2F&doc2=https%3A%2F%2Fw3c.github.io%2Fwebauthn%2F

Requirements satisfied

Yes

Wide Review

Web Payments WG
“The Web Authentication WG and the Web Payments WG launched a joint task force in October 2019 to help ensure that payments use cases can be addressed by Web Authentication. Although this collaboration has not involved formal review of Web Authentication Level 2, it has involved usage of the specification and led to a number of feature proposals, including:

  1. The ability to call Web Authentication get() from within an iframe. This is a common coding pattern in the payment industry, where the payment service provider code runs in an iframe in the merchant page.
  2. Secure Payment Confirmation (SPC), which “marries” Web Authentication and Payment Request API to
    improve the user experience. This work is motivated in particular by regulatory requirements in Europe (PSD2) involving both strong customer authentication (SCA) and transaction confirmation (“dynamic linking”).
    In short, the Web Payments Working Group is an active consumer of Web Authentication and has engaged payments industry stakeholders around the adoption of Web Authentication."

PING
issues addressed

Security
Security Review Request for WebAuthn Level 2 (Monday, 19 October) -- no issues

i18n
Review Requested and Editorial issues filed

APA WG
Accessibility Review Request for WebAuthn Level 2 (Monday, 19 October)

Issues addressed

Editorial issues will move to Level 3

Formal Objections

None

Implementation

Two Browser implementations: Chrome and Edge
Implementation report (from WPT tests: https://www.w3.org/2020/12/webauthn-report.html )

Patent disclosures

None
February 20 2021: Last day of the 60 day exclusion opportunity that began from Candidate Recommendation
@YubicoDemo YubicoDemo added [DO NOT USE] Awaiting Director Deprecated. Use Awaiting Team Verification. Entering PR Proposed Recommendation labels Feb 17, 2021
@YubicoDemo YubicoDemo changed the title PR Request for <title> PR Request for Web Authentication:
An API for accessing Public Key Credentials
Level 2 Feb 17, 2021
@YubicoDemo YubicoDemo changed the title PR Request for Web Authentication:
An API for accessing Public Key Credentials
Level 2 PR Request for Web Authentication:
An API for accessing Public Key Credentials 
Level 2 Feb 17, 2021
@YubicoDemo YubicoDemo changed the title PR Request for Web Authentication:
An API for accessing Public Key Credentials 
Level 2 PR Request for Web Authentication:
 An API for accessing Public Key Credentials 
Level 2 Feb 17, 2021
@YubicoDemo
Copy link
Author

We will produce a Diff after our meeting tomorrow 17 02 2021

@wseltzer wseltzer removed the [DO NOT USE] Awaiting Director Deprecated. Use Awaiting Team Verification. label Feb 17, 2021
@wseltzer
Copy link
Member

Diff: https://services.w3.org/htmldiff?doc1=https%3A%2F%2Fwww.w3.org%2FTR%2Fwebauthn-2%2F&doc2=https%3A%2F%2Fw3c.github.io%2Fwebauthn%2F

@wseltzer wseltzer added the [DO NOT USE] Awaiting Director Deprecated. Use Awaiting Team Verification. label Feb 17, 2021
@plehegar
Copy link
Member

plehegar commented Feb 19, 2021 •
edited
Loading

(waiting on final ack from horizontal groups)

@plehegar
Copy link
Member

APA closed their issue: https://www.w3.org/2021/02/24-apa-minutes.html#t05

@plehegar
Copy link
Member

i18n closed their issue: https://lists.w3.org/Archives/Member/member-i18n-core/2021Feb/0012.html

@swickr
Copy link
Contributor

swickr commented Feb 24, 2021 •
edited
Loading

The cited staged version is missing the added section 15 Accessibility Considerations.

(I note that the implementation report actually includes more than 2 browser engines.)

Once this is fixed, transition to Proposed Rec is approved.

@swickr swickr assigned wseltzer and unassigned swickr Feb 24, 2021
@swickr swickr added Awaiting Team Contact and removed [DO NOT USE] Awaiting Director Deprecated. Use Awaiting Team Verification. labels Feb 24, 2021
@wseltzer
Copy link
Member

Thank you @swickr. Now corrected at https://www.w3.org/TR/2021/PR-webauthn-2-20210225/

@wseltzer wseltzer added Awaiting Publication Approved by the Director, waiting on publication and removed Awaiting Team Contact labels Feb 24, 2021
@plehegar
Copy link
Member

https://www.w3.org/TR/2021/PR-webauthn-2-20210225/

@plehegar plehegar mentioned this issue Apr 7, 2021
Closed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@wseltzer wseltzer

Labels
Awaiting Publication Approved by the Director, waiting on publication Entering PR Proposed Recommendation
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
4 participants
@wseltzer @plehegar @swickr @YubicoDemo