From 970210b8cea80b972c973f6ece5a279123468f8f Mon Sep 17 00:00:00 2001 From: CI Bot Date: Wed, 11 May 2016 22:36:37 +0000 Subject: [PATCH] Script updating gh-pages. [ci skip] --- index.html | 174 ++++++++++++++++++++++++++++++++--------------------- 1 file changed, 105 insertions(+), 69 deletions(-) diff --git a/index.html b/index.html index 3136c23d0..f7c47ee90 100644 --- a/index.html +++ b/index.html @@ -180,7 +180,7 @@

W3C

Web Authentication: A Web API for accessing scoped credentials

-

Editor’s Draft,

+

Editor’s Draft,

@@ -339,7 +339,7 @@

Table of Contents

  • 5.6 Example extension
  • - 6 Standard extensions + 6 Pre-defined extensions
    1. 6.1 Transaction authorization
    2. 6.2 Authenticator Selection Extension @@ -404,8 +404,8 @@

      On the phone:

    • -

    3.3. User Account Information (dictionary Account#dictdef-accountReferenced in:3. Web Authentication API (2))

    +

    3.3. User Account Information (dictionary Account#dictdef-accountReferenced in:3. Web Authentication API (2)4.1.1. The authenticatorMakeCredential operation)

    This dictionary is used by the caller to specify information about the user account and WebAuthn Relying Party with which a credential is to be associated. It is intended to help the authenticator in providing a friendly credential selection interface for the @@ -759,7 +773,7 @@

    imageURL member contains a URL that resolves to the user’s account image. This may be a URL that can be used to retrieve an image containing the user’s current avatar, or a data URI that contains the image data.

    -

    3.4. Parameters for Credential Generation (dictionary ScopedCredentialParameters#dictdef-scopedcredentialparametersReferenced in:3. Web Authentication API (2))

    +

    3.4. Parameters for Credential Generation (dictionary ScopedCredentialParameters#dictdef-scopedcredentialparametersReferenced in:3. Web Authentication API (2)3.1.1. Create a new credential (makeCredential() method))

    This dictionary is used to supply additional parameters when creating a new credential.

    The type member specifies the type of credential to be created.

    @@ -800,24 +814,25 @@

    3.8. Supporting Data Structures

    The scoped credential type uses certain data structures that are specified in supporting specifications. These are as follows.

    -

    3.8.1. Credential Type enumeration (enum CredentialType#enumdef-credentialtypeReferenced in:3. Web Authentication API (2) (3)3.1.1. Create a new credential (makeCredential() method))

    +

    3.8.1. Credential Type enumeration (enum CredentialType#enumdef-credentialtypeReferenced in:3. Web Authentication API (2) (3)3.1.1. Create a new credential (makeCredential() method)3.8.2. Unique Identifier for Credential (interface Credential)4.1.1. The authenticatorMakeCredential operation)

    This enumeration defines the valid credential types. It is an extension point; values may be added to it in the future, as more credential types are defined. The values of this enumeration are used for versioning the WebAuthn assertion and attestation statement according to the type of the authenticator.

    Currently one credential type is defined, namely "ScopedCred".

    -

    3.8.2. Unique Identifier for Credential (interface Credential#credentialReferenced in:3. Web Authentication API (2) (3) (4) (5))

    +

    3.8.2. Unique Identifier for Credential (interface Credential#credentialReferenced in:3. Web Authentication API (2) (3) (4) (5)4.1.1. The authenticatorMakeCredential operation)

    This interface contains the attributes that are returned to the caller when a new credential is created, and can be used later by the caller to select a credential for use.

    - The type attribute indicates the specification and version that this credential conforms to. + The type attribute contains a value of type CredentialType, indicating the specification and version that + this credential conforms to.

    The id attribute contains an identifier for the credential, chosen by the platform with help from the authenticator. This identifier is used to look up credentials for use, and is therefore expected to be globally unique with - high probability across all credentials of the same type. This API does not constrain the format or length of this - identifier, except that it must be sufficient for the platform to uniquely select a key. For example, an authenticator - without on-board storage may create identifiers that consist of the key material wrapped with a key that is burned into the - authenticator.

    + high probability across all credentials of the same type, across all authenticators. This API does not constrain the format + or length of this identifier, except that it must be sufficient for the platform to uniquely select a key. For example, an + authenticator without on-board storage may create identifiers that consist of the key material wrapped with a key that is + burned into the authenticator.

    3.8.3. Cryptographic Algorithm Identifier (type AlgorithmIdentifier)

    A string or dictionary identifying a cryptographic algorithm and optionally a set of parameters for that algorithm. This type is @@ -843,13 +858,25 @@

    The RP ID corresponding to the above web origin, as determined by the user agent and the client.

  • -

    All input parameters accepted by the makeCredential() method.

    +

    The Account information provided by the WebAuthn Relying Party.

    +
  • +

    The CredentialType requested by the WebAuthn Relying Party.

    +
  • +

    The cryptographic parameters requested by the WebAuthn Relying Party, with the cryptographic algorithms normalized as per the procedure in Web Cryptography API §algorithm-normalization-normalize-an-algorithm.

    +
  • +

    A list of Credential objects provided by the WebAuthn Relying Party with the intention that, if any of these are known to the authenticator, +it should not create a new credential.

    +
  • +

    A challenge provided by the WebAuthn Relying Party to assure freshness of the attestation statement of the new credential.

    +
  • +

    Extension data created by the client based on the extensions requested by the WebAuthn Relying Party.

    When this operation is invoked, the authenticator obtains user consent for creating a new credential. The prompt for obtaining -this consent is shown by the authenticator if it has its own output capability, or by the user agent otherwise. Once user -consent is obtained, the authenticator generates the appropriate cryptographic keys and creates a new credential. It then -associates the credential with the specified RP ID such that it will be able to retrieve the RP ID later, given the credential -ID.

    +this consent is shown by the authenticator if it has its own output capability, or by the user agent otherwise. Once user +consent is obtained, the authenticator generates the appropriate cryptographic keys and creates a new credential. It also +generates an identifier for the credential, such that this identifier is globally unique with high probability across all +credentials with the same type across all authenticators. It then associates the credential with the specified RP ID such that +it will be able to retrieve the RP ID later, given the credential ID.

    On successful completion of this operation, the authenticator returns the type and unique identifier of this new credential to the user agent.

    If the user refuses consent, the authenticator returns an appropriate error status to the client.

    @@ -862,7 +889,11 @@

    The RP ID corresponding to the above web origin, as determined by the user agent and the client.

  • -

    All input parameters accepted by the getAssertion() method, specified below.

    +

    A challenge provided by the WebAuthn Relying Party to assure freshness of the assertion produced.

    +
  • +

    A list of credentials acceptable to the WebAuthn Relying Party (possibly filtered by the client).

    +
  • +

    Extension data created by the client based on the extensions requested by the WebAuthn Relying Party.

    When this method is invoked, the authenticator allows the user to select a credential from among the credentials associated with that WebAuthn Relying Party and matching the specified criteria, then obtains user consent for using that credential. The prompt for obtaining @@ -885,18 +916,17 @@

    -

    The WebAuthn Relying Party (RP), which uses the WebAuthn services. The RP may, for example, be a web-application running in a browser, -or a native application that runs directly on the OS platform.

    +

    The WebAuthn Relying Party (RP), which uses the WebAuthn services. The RP consists of a server component and a web-application running +in a browser.

  • -

    The WebAuthn Client platform, which consists of the user’s OS and device used to host the RP’s client-side app. For -web-applications, the browser also belongs to this layer.

    +

    The WebAuthn Client platform, which consists of the User Agent and the OS and device on which it executes.

  • -

    The Authenticator itself, which provides key management and cryptographic signatures.

    +

    The Authenticator itself, which provides key management and cryptographic signatures. This may be embedded in the +WebAuthn client, or houesd in a separate device entirely. In the latter case, the interface between the WebAuthn client and +the authenticator is a separately-defined protocol.

    -

    When the WebAuthn Relying Party client-side application is a web-application, the interface between 1 and 2 is the §3 Web Authentication API, but is platform -specific for native applications. In cases where the authenticator is not tightly integrated with the platform, the interface -between 2 and 3 is a separately-defined protocol. This specification defines the common signature format shared by all layers. -This includes how the different contextual bindings are encoded, signed over, and delivered to the RP.

    +

    This specification defines the common signature format shared by all the above layers. This includes how the different +contextual bindings are encoded, signed over, and delivered to the RP.

    The goals of this design can be summarized as follows.