Skip to content

Commit

Permalink
incorporated agl's review feedback
Browse files Browse the repository at this point in the history
  • Loading branch information
timcappalli committed Apr 22, 2022
1 parent eb915ef commit 03b829e
Showing 1 changed file with 12 additions and 12 deletions.
24 changes: 12 additions & 12 deletions index.bs
Original file line number Diff line number Diff line change
Expand Up @@ -974,20 +974,20 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S

: <dfn>Backup</dfn>
: <dfn>Backed Up</dfn>
:: [=Public Key Credential Sources=] may be [=backed up=] in some fashion such that they may become present on an authenticator other
than their [=generating authenticator=]. [=Backup=] can occur via mechanisms including but not limited to peer-to-peer sync,
:: [=Public Key Credential Sources=] may be backed up in some fashion such that they may become present on an authenticator other
than their [=generating authenticator=]. Backup can occur via mechanisms including but not limited to peer-to-peer sync,
cloud sync, local network sync, and manual import/export. See also [[#sctn-credential-backup]].

: <dfn>Backup Eligibility</dfn>
: <dfn>Backup Eligible</dfn>
:: A [=Public Key Credential Source=]'s [=generating authenticator=] determines at creation time whether the [=public key credential source=]
is allowed to be [=backed up=]. [=Backup eligibility=] is signaled in [=authenticator data=]'s [=flags=] along with the current [=backup state=].
[=Backup eligibility=] is a [=credential property=] and is permanent for a given [=public key credential source=].
A [=backup eligible=] [=public key credential source=] is referred to as a <dfn>multi-device credential</dfn> whereas one that is not
[=backup eligible=] is referred to as a <dfn>single-device credential</dfn>. See also [[#sctn-credential-backup]].
is allowed to be [=backed up=]. Backup eligibility is signaled in [=authenticator data=]'s [=flags=] along with the current [=backup state=].
Backup eligibility is a [=credential property=] and is permanent for a given [=public key credential source=].
A backup eligible [=public key credential source=] is referred to as a <dfn>multi-device credential</dfn> whereas one that is not
backup eligible is referred to as a <dfn>single-device credential</dfn>. See also [[#sctn-credential-backup]].

: <dfn>Backup State</dfn>
:: The current [=backup state=] of a [=multi-device credential=] as determined by the current [=managing authenticator=]. [=Backup state=] is
:: The current backup state of a [=multi-device credential=] as determined by the current [=managing authenticator=]. Backup state is
signaled in [=authenticator data=]'s [=flags=] and can change over time. See also [=backup eligibility=] and [[#sctn-credential-backup]].

: <dfn>Biometric Recognition</dfn>
Expand Down Expand Up @@ -1117,9 +1117,9 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S
[=client-side discoverable credential=] or a [=server-side credential=].

: <dfn>Generating Authenticator</dfn>
:: The [=Generating Authenticator=] is the authenticator involved in the [=authenticatorMakeCredential=] operation resulting
:: The Generating Authenticator is the authenticator involved in the [=authenticatorMakeCredential=] operation resulting
in the creation of a given [=pubic key credential source=]. The [=generating authenticator=] is the same as the [=managing authenticator=]
for [=single-device credentials=]. For [=multi-device credentials=], the [=generating authenticator=] may or may not be the same as the
for [=single-device credentials=]. For [=multi-device credentials=], the generating authenticator may or may not be the same as the
current [=managing authenticator=] participating in a given [=authentication=] operation.

: <dfn>Human Palatability</dfn>
Expand Down Expand Up @@ -3741,12 +3741,12 @@ valid combinations and their meaning.

It is RECOMMENDED that [=[RPS]=] store the most recent value of these [=flags=] with the [=user account=] for future evaluation.

The following is a non-normative, non-exhaustive list of how [=[RPS]=] might utilize these [=flags=]:
The following is a non-normative, non-exhaustive list of how [=[RPS]=] might use these [=flags=]:

- Requiring additional [=authenticators=]:

When `BE` [=flag=] is set to `0`, the [=generating authenticator=] will never allow the credential to transition from a
[=single-device credential=] to a [=multi-device credential=].
When `BE` [=flag=] is set to `0`, the credential is a [=single-device credential=] and the [=generating authenticator=] will never
allow the credential to be backed up.

A [=single-device credential=] is not resilient to single device loss. [=[RPS]=] SHOULD ensure that a [=user account=]
has additional [=authenticators=] [=registration ceremony|registered=] and/or an account recovery process in place.
Expand Down

0 comments on commit 03b829e

Please sign in to comment.