Skip to content

Commit

Permalink
Use [RP] and [WRP] macros
Browse files Browse the repository at this point in the history
  • Loading branch information
emlun committed Jun 13, 2022
1 parent 613aed4 commit 684cd91
Showing 1 changed file with 6 additions and 6 deletions.
12 changes: 6 additions & 6 deletions index.bs
Expand Up @@ -2690,7 +2690,7 @@ associated with or [=scoped=] to, respectively.
</div>


### Relying Party Parameters for Credential Generation (dictionary <dfn dictionary>PublicKeyCredentialRpEntity</dfn>) ### {#dictionary-rp-credential-params}
### [RP] Parameters for Credential Generation (dictionary <dfn dictionary>PublicKeyCredentialRpEntity</dfn>) ### {#dictionary-rp-credential-params}

The {{PublicKeyCredentialRpEntity}} dictionary is used to supply additional [=[RP]=] attributes when creating a new credential.

Expand Down Expand Up @@ -3753,15 +3753,15 @@ The following is a non-normative, non-exhaustive list of how [=[RPS]=] might use

When the `BS` [=flag=] changes from `0` to `1`, the [=authenticator=] is signaling that the [=credential=] is backed up and is protected from single device loss.

A [=Relying Party=] may decide to prompt the user to upgrade their account security and remove their password.
A [=[RP]=] may decide to prompt the user to upgrade their account security and remove their password.

- Adding an additional factor after a state change:

When the `BS` [=flag=] changes from `1` to `0`, the [=authenticator=] is signaling that the [=credential=] is no longer backed up,
and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
or errors, such as issues with the backup service.

When this transition occurs, the [=Relying Party=] SHOULD guide the user through a process to validate their other sign in factors.
When this transition occurs, the [=[RP]=] SHOULD guide the user through a process to validate their other sign in factors.
If the user does not have another credential for their account, they SHOULD be guided through adding an additional authentication factor
to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional [=authenticator=],
such as a [=roaming authenticator=] or an [=authenticator=] that is capable of [=multi-device credentials=].
Expand Down Expand Up @@ -4861,7 +4861,7 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o
1. If the [=[RP]=] requires [=user verification=] for this assertion,
verify that the [=User Verified=] bit of the <code>[=flags=]</code> in |authData| is set.

1. If the credential [=backup state=] is used as part of Relying Party business logic or policy, compare the previously stored
1. If the credential [=backup state=] is used as part of [=[RP]=] business logic or policy, compare the previously stored
value with the [=backup state=] (BS) bit of the <code>[=flags=]</code> in |authData|, perform evaluation, and then store the new value.

1. Verify that the values of the [=client extension outputs=] in |clientExtensionResults| and the [=authenticator extension
Expand Down Expand Up @@ -6721,7 +6721,7 @@ This section registers the below-listed attestation statement formats, newly def
- Specification Document: Section [[#sctn-apple-anonymous-attestation]] of this specification
<br/><br/>
- WebAuthn Attestation Statement Format Identifier: none
- Description: Used to replace any authenticator-provided attestation statement when a WebAuthn Relying Party indicates it does not wish to receive attestation information.
- Description: Used to replace any authenticator-provided attestation statement when a [=[WRP]=] indicates it does not wish to receive attestation information.
- Specification Document: Section [[#sctn-none-attestation]] of this specification


Expand Down Expand Up @@ -6892,7 +6892,7 @@ to avoid replay attacks. Therefore, the values of both {{PublicKeyCredentialCrea
by [=[RPS]=] in an environment they trust (e.g., on the server-side), and the
returned {{CollectedClientData/challenge}} value in the client's
response MUST match what was generated. This SHOULD be done in a fashion that does not rely
upon a client's behavior, e.g., the Relying Party SHOULD store the challenge temporarily
upon a client's behavior, e.g., the [=[RP]=] SHOULD store the challenge temporarily
until the operation is complete. Tolerating a mismatch will compromise the security
of the protocol.

Expand Down

0 comments on commit 684cd91

Please sign in to comment.