Skip to content

Commit

Permalink
Merge pull request #997 from w3c/replace-local-remote-terms
Browse files Browse the repository at this point in the history
Replace local/remote storage terms with client/server side
  • Loading branch information
emlun committed Jul 18, 2018
2 parents a0d84c1 + 6f4fbe6 commit 8d6b9ac
Showing 1 changed file with 12 additions and 11 deletions.
23 changes: 12 additions & 11 deletions index.bs
Original file line number Diff line number Diff line change
Expand Up @@ -502,7 +502,7 @@ The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "S
: <dfn>Client-side-resident Public Key Credential Source</dfn>
:: A [=Client-side-resident Public Key Credential Source=], or [=Resident Credential=] for short, is a [=public key credential
source=] whose [=credential private key=] is stored in the [=authenticator=], [=client=] or [=client device=]. Such
[=client-side=] storage requires a [=local storage capable=] [=authenticator=] and has the property that the [=authenticator=]
[=client-side=] storage requires a [=resident credential capable=] [=authenticator=] and has the property that the [=authenticator=]
is able to select the [=credential private key=] given
only an [=RP ID=], possibly with user assistance (e.g., by providing the user a pick list of [=public key credential|credentials=] associated with the [=RP ID=]).
By definition, the [=credential private key=] is always exclusively controlled by the [=authenticator=]. In the case of a
Expand Down Expand Up @@ -2527,37 +2527,37 @@ the same procedure as other [=assertion signatures=] generated by the [=authenti
<tr>
<th> <dfn>Second-factor platform authenticator</dfn> </th>
<td> [=platform attachment|platform=] </td>
<td> [=remote credential storage modality|Remote=] </td>
<td> [=server-side credential storage modality|Server-side storage=] </td>
<td> [=single-factor capable|Single-factor=] </td>
</tr>
<tr>
<th> <dfn>User-verifying platform authenticator</dfn> </th>
<td> [=platform attachment|platform=] </td>
<td> [=remote credential storage modality|Remote=] </td>
<td> [=server-side credential storage modality|Server-side storage=] </td>
<td> [=multi-factor capable|Multi-factor=] </td>
</tr>
<tr>
<th> <dfn>First-factor platform authenticator</dfn> </th>
<td> [=platform attachment|platform=] </td>
<td> [=local credential storage modality|Local=] </td>
<td> [=client-side credential storage modality|Client-side storage=] </td>
<td> [=multi-factor capable|Multi-factor=] </td>
</tr>
<tr>
<th> <dfn>Second-factor roaming authenticator</dfn> </th>
<td> [=cross-platform attachment|cross-platform=] </td>
<td> [=remote credential storage modality|Remote=] </td>
<td> [=server-side credential storage modality|Server-side storage=] </td>
<td> [=single-factor capable|Single-factor=] </td>
</tr>
<tr>
<th> <dfn>User-verifying roaming authenticator</dfn> </th>
<td> [=cross-platform attachment|cross-platform=] </td>
<td> [=remote credential storage modality|Remote=] </td>
<td> [=server-side credential storage modality|Server-side storage=] </td>
<td> [=multi-factor capable|Multi-factor=] </td>
</tr>
<tr>
<th> <dfn>First-factor roaming authenticator</dfn> </th>
<td> [=cross-platform attachment|cross-platform=] </td>
<td> [=local credential storage modality|Local=] </td>
<td> [=client-side credential storage modality|Client-side storage=] </td>
<td> [=multi-factor capable|Multi-factor=] </td>
</tr>
</tbody>
Expand Down Expand Up @@ -2623,13 +2623,14 @@ An [=authenticator=] can store a [=public key credential source=] in one of two
Which of these storage strategies an [=authenticator=] supports defines the [=authenticator=]'s <dfn>credential storage
modality</dfn> as follows:

- An [=authenticator=] has the <dfn>local credential storage modality</dfn> if it supports [=resident credentials=]. An
[=authenticator=] with [=local credential storage modality=] is also called <dfn>local storage capable</dfn>.
- An [=authenticator=] has the <dfn>client-side credential storage modality</dfn> if it supports [=client-side-resident public key
credential sources=]. An [=authenticator=] with [=client-side credential storage modality=] is also called <dfn>resident
credential capable</dfn>.

- An [=authenticator=] has the <dfn>remote credential storage modality</dfn> if it does not have the [=local credential storage
- An [=authenticator=] has the <dfn>server-side credential storage modality</dfn> if it does not have the [=client-side credential storage
modality=], i.e., it only supports storing [=credential private keys=] as a ciphertext in the [=credential ID=].

Note that a [=local storage capable=] [=authenticator=] MAY support both storage strategies. In this case, the [=authenticator=] MAY
Note that a [=resident credential capable=] [=authenticator=] MAY support both storage strategies. In this case, the [=authenticator=] MAY
at its discretion use different storage strategies for different [=public key credential|credentials=], though subject to the
{{AuthenticatorSelectionCriteria/requireResidentKey}} option of {{CredentialsContainer/create()}}.

Expand Down

0 comments on commit 8d6b9ac

Please sign in to comment.