Skip to content

Commit

Permalink
Rename MakePublicKeyCredentialOptions to PublicKeyCredentialCreateOpt…
Browse files Browse the repository at this point in the history
…ions (#779)

* Rename MakePublicKeyCredentialOptions to PublicKeyCredentialCreateOptions

* Changed PublicKeyCredentialCreateOptions to PublicKeyCredentialCreationOptions
  • Loading branch information
selfissued committed Feb 7, 2018
1 parent 42cc9dc commit ca4cf0f
Showing 1 changed file with 30 additions and 30 deletions.
60 changes: 30 additions & 30 deletions index.bs
Expand Up @@ -678,7 +678,7 @@ the {{CredentialCreationOptions}} dictionary as follows:

<pre class="idl">
partial dictionary CredentialCreationOptions {
MakePublicKeyCredentialOptions publicKey;
PublicKeyCredentialCreationOptions publicKey;
};
</pre>

Expand Down Expand Up @@ -716,7 +716,7 @@ This [=internal method=] accepts three arguments:

: <dfn>options</dfn>
:: This argument is a {{CredentialCreationOptions}} object whose
<code>|options|.{{CredentialCreationOptions/publicKey}}</code> member contains a {{MakePublicKeyCredentialOptions}}
<code>|options|.{{CredentialCreationOptions/publicKey}}</code> member contains a {{PublicKeyCredentialCreationOptions}}
object specifying the desired attributes of the to-be-created [=public key credential=].

: <dfn>sameOriginWithAncestors</dfn>
Expand Down Expand Up @@ -746,9 +746,9 @@ When this method is invoked, the user agent MUST execute the following algorithm

1. Let |options| be the value of <code>|options|.{{CredentialCreationOptions/publicKey}}</code>.

1. If the {{MakePublicKeyCredentialOptions/timeout}} member of |options| is [=present=], check if its value lies within a
1. If the {{PublicKeyCredentialCreationOptions/timeout}} member of |options| is [=present=], check if its value lies within a
reasonable range as defined by the platform and if not, correct it to the closest value lying within that range. Set a timer
|lifetimeTimer| to this adjusted value. If the {{MakePublicKeyCredentialOptions/timeout}} member of |options| is [=present|not
|lifetimeTimer| to this adjusted value. If the {{PublicKeyCredentialCreationOptions/timeout}} member of |options| is [=present|not
present=], then set |lifetimeTimer| to a platform-specific default.

1. Let |callerOrigin| be {{PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)/origin}}. If |callerOrigin| is an [=opaque origin=], return a {{DOMException}} whose name is
Expand All @@ -766,44 +766,44 @@ When this method is invoked, the user agent MUST execute the following algorithm
-->
<li id='CreateCred-DetermineRpId'>

If <code>|options|.{{MakePublicKeyCredentialOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code>
If <code>|options|.{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code>
<dl class="switch">

: Is [=present=]
:: If <code>|options|.{{MakePublicKeyCredentialOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> [=is not a
:: If <code>|options|.{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> [=is not a
registrable domain suffix of and is not equal to=] |effectiveDomain|, return a {{DOMException}} whose name
is "{{SecurityError}}", and terminate this algorithm.

: Is [=present|not present=]
:: Set <code>|options|.{{MakePublicKeyCredentialOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> to
:: Set <code>|options|.{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> to
|effectiveDomain|.
</dl>

Note: <code>|options|.{{MakePublicKeyCredentialOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> represents the
Note: <code>|options|.{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> represents the
caller's [=RP ID=]. The [=RP ID=] defaults to being the caller's [=environment settings object/origin=]'s
[=effective domain=] unless the caller has explicitly set
<code>|options|.{{MakePublicKeyCredentialOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> when calling
<code>|options|.{{PublicKeyCredentialCreationOptions/rp}}.{{PublicKeyCredentialRpEntity/id}}</code> when calling
{{CredentialsContainer/create()}}.
</li>

1. Let |credTypesAndPubKeyAlgs| be a new [=list=] whose [=list/items=] are pairs of {{PublicKeyCredentialType}} and
a {{COSEAlgorithmIdentifier}}.

1. [=list/For each=] |current| of <code>|options|.{{MakePublicKeyCredentialOptions/pubKeyCredParams}}</code>:
1. [=list/For each=] |current| of <code>|options|.{{PublicKeyCredentialCreationOptions/pubKeyCredParams}}</code>:

1. If <code>|current|.{{PublicKeyCredentialParameters/type}}</code> does not contain a {{PublicKeyCredentialType}} supported
by this implementation, then [=continue=].
1. Let |alg| be <code>|current|.{{PublicKeyCredentialParameters/alg}}</code>.
1. [=list/Append=] the pair of <code>|current|.{{PublicKeyCredentialParameters/type}}</code> and |alg| to
|credTypesAndPubKeyAlgs|.

1. If |credTypesAndPubKeyAlgs| [=list/is empty=] and <code>|options|.{{MakePublicKeyCredentialOptions/pubKeyCredParams}}</code>
1. If |credTypesAndPubKeyAlgs| [=list/is empty=] and <code>|options|.{{PublicKeyCredentialCreationOptions/pubKeyCredParams}}</code>
[=list/is not empty=], return a {{DOMException}} whose name is "{{NotSupportedError}}", and terminate this algorithm.

1. Let |clientExtensions| be a new [=map=] and let |authenticatorExtensions| be a new [=map=].

1. If the {{MakePublicKeyCredentialOptions/extensions}} member of |options| is [=present=], then [=map/for each=]
|extensionId| → |clientExtensionInput| of <code>|options|.{{MakePublicKeyCredentialOptions/extensions}}</code>:
1. If the {{PublicKeyCredentialCreationOptions/extensions}} member of |options| is [=present=], then [=map/for each=]
|extensionId| → |clientExtensionInput| of <code>|options|.{{PublicKeyCredentialCreationOptions/extensions}}</code>:
1. If |extensionId| is not supported by this client platform or is not a [=registration extension=], then [=continue=].

1. [=map/Set=] |clientExtensions|[|extensionId|] to |clientExtensionInput|.
Expand All @@ -819,7 +819,7 @@ When this method is invoked, the user agent MUST execute the following algorithm
: {{CollectedClientData/type}}
:: The string "webauthn.create".
: {{CollectedClientData/challenge}}
:: The [=base64url encoding=] of |options|.{{MakePublicKeyCredentialOptions/challenge}}.
:: The [=base64url encoding=] of |options|.{{PublicKeyCredentialCreationOptions/challenge}}.
: {{CollectedClientData/origin}}
:: The [=ascii serialization of an origin|serialization of=] |callerOrigin|.
: {{CollectedClientData/tokenBindingId}}
Expand Down Expand Up @@ -849,20 +849,20 @@ When this method is invoked, the user agent MUST execute the following algorithm
Resolving this with good definitions or some other means will be addressed by resolving
[Issue #613](https://github.com/w3c/webauthn/issues/613).

1. If <code>|options|.{{MakePublicKeyCredentialOptions/authenticatorSelection}}</code> is [=present=]:
1. If <code>|options|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}</code> is [=present=]:

1. If <code>|options|.{{MakePublicKeyCredentialOptions/authenticatorSelection}}.{{authenticatorAttachment}}</code> is
1. If <code>|options|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{authenticatorAttachment}}</code> is
[=present|present=] and its value is not equal to |authenticator|'s attachment modality, [=iteration/continue=].
1. If <code>|options|.{{MakePublicKeyCredentialOptions/authenticatorSelection}}.{{requireResidentKey}}</code> is set to
1. If <code>|options|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{requireResidentKey}}</code> is set to
`true` and the |authenticator| is not capable of storing a [=Client-Side-Resident Credential Private Key=],
[=iteration/continue=].
1. If <code>|options|.{{MakePublicKeyCredentialOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/userVerification}}</code> is
1. If <code>|options|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/userVerification}}</code> is
set to {{UserVerificationRequirement/required}} and the |authenticator| is not capable of performing [=user
verification=], [=iteration/continue=].

1. Let |userVerification| be the <dfn>effective user verification requirement for credential creation</dfn>, a Boolean value,
as follows. If
<code>|options|.{{MakePublicKeyCredentialOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/userVerification}}</code>
<code>|options|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/userVerification}}</code>

<dl class="switch">

Expand All @@ -889,16 +889,16 @@ When this method is invoked, the user agent MUST execute the following algorithm

1. Let |excludeCredentialDescriptorList| be a new [=list=].

1. [=list/For each=] credential descriptor |C| in <code>|options|.{{MakePublicKeyCredentialOptions/excludeCredentials}}</code>:
1. [=list/For each=] credential descriptor |C| in <code>|options|.{{PublicKeyCredentialCreationOptions/excludeCredentials}}</code>:
1. If <code>|C|.{{transports}}</code> [=list/is not empty=], and |authenticator| is connected over a transport not
mentioned in <code>|C|.{{transports}}</code>, the client MAY [=continue=].
1. Otherwise, [=list/Append=] |C| to |excludeCredentialDescriptorList|.

<!-- @@EDITOR-ANCHOR-01A: KEEP THIS LIST SYNC'D WITH THE LIST UP AT @@EDITOR-ANCHOR-01B -->
1. Invoke the [=authenticatorMakeCredential=] operation on |authenticator| with
|clientDataHash|,
<code>|options|.{{MakePublicKeyCredentialOptions/rp}}</code>, <code>|options|.{{MakePublicKeyCredentialOptions/user}}</code>,
<code>|options|.{{MakePublicKeyCredentialOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/requireResidentKey}}</code>,
<code>|options|.{{PublicKeyCredentialCreationOptions/rp}}</code>, <code>|options|.{{PublicKeyCredentialCreationOptions/user}}</code>,
<code>|options|.{{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{AuthenticatorSelectionCriteria/requireResidentKey}}</code>,
|userPresence|,
|userVerification|,
|credTypesAndPubKeyAlgs|,
Expand Down Expand Up @@ -945,7 +945,7 @@ When this method is invoked, the user agent MUST execute the following algorithm
:: whose value is the bytes of |clientDataJSON|.

: <code><dfn for="credentialCreationData">attestationConveyancePreferenceOption</dfn></code>
:: whose value is the value of |options|.{{MakePublicKeyCredentialOptions/attestation}}.
:: whose value is the value of |options|.{{PublicKeyCredentialCreationOptions/attestation}}.

: <code><dfn for="credentialCreationData">clientExtensionResults</dfn></code>
:: whose value is an {{AuthenticationExtensionsClientOutputs}} object containing [=extension identifier=]
Expand Down Expand Up @@ -1546,10 +1546,10 @@ optionally evidence of [=user consent=] to a specific transaction.
a message to the authenticator, which may be sent over a low-bandwidth link.
</div>

## Options for Credential Creation (dictionary <dfn dictionary>MakePublicKeyCredentialOptions</dfn>) ## {#dictionary-makecredentialoptions}
## Options for Credential Creation (dictionary <dfn dictionary>PublicKeyCredentialCreationOptions</dfn>) ## {#dictionary-makecredentialoptions}

<xmp class="idl">
dictionary MakePublicKeyCredentialOptions {
dictionary PublicKeyCredentialCreationOptions {
required PublicKeyCredentialRpEntity rp;
required PublicKeyCredentialUserEntity user;

Expand All @@ -1563,7 +1563,7 @@ optionally evidence of [=user consent=] to a specific transaction.
AuthenticationExtensionsClientInputs extensions;
};
</xmp>
<div dfn-type="dict-member" dfn-for="MakePublicKeyCredentialOptions">
<div dfn-type="dict-member" dfn-for="PublicKeyCredentialCreationOptions">
: <dfn>rp</dfn>
:: This member contains data about the [=[RP]=] responsible for the request.

Expand Down Expand Up @@ -2290,7 +2290,7 @@ It takes the following input parameters:
: |userEntity|
:: The user account's {{PublicKeyCredentialUserEntity}}, containing the [=user handle=] given by the [=[RP]=].
: |requireResidentKey|
:: The {{MakePublicKeyCredentialOptions/authenticatorSelection}}.{{requireResidentKey}} value given by the [=[RP]=].
:: The {{PublicKeyCredentialCreationOptions/authenticatorSelection}}.{{requireResidentKey}} value given by the [=[RP]=].
: |requireUserPresence|
:: A Boolean value provided by the client, which in invocations from a [=[WAC]=]'s
{{PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)}} method is always set to the inverse of
Expand Down Expand Up @@ -2853,7 +2853,7 @@ When registering a new credential, represented by a {{AuthenticatorAttestationRe

1. If the attestation statement |attStmt| verified successfully and is found to be trustworthy, then register the new
credential with the account that was denoted in the
{{PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)/options}}.{{MakePublicKeyCredentialOptions/user}} passed to
{{PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)/options}}.{{PublicKeyCredentialCreationOptions/user}} passed to
{{CredentialsContainer/create()}}, by associating it with the <code>[=credentialId=]</code> and
<code>[=credentialPublicKey=]</code> in the <code>[=attestedCredentialData=]</code> in |authData|, as appropriate for the
[=[RP]=]'s system.
Expand Down Expand Up @@ -3583,7 +3583,7 @@ while the [=CBOR=] <dfn>authenticator extension input</dfn> is
passed from the client to the authenticator for [=authenticator extensions=] during the processing of these calls.

A [=[RP]=] simultaneously requests the use of an extension and sets its [=client extension input=] by including an entry in the
{{MakePublicKeyCredentialOptions/extensions}} option to the {{CredentialsContainer/create()}} or {{CredentialsContainer/get()}} call.
{{PublicKeyCredentialCreationOptions/extensions}} option to the {{CredentialsContainer/create()}} or {{CredentialsContainer/get()}} call.
The entry key is the [=extension identifier=] and the value is the [=client extension input=].

<pre class="example" highlight="js">
Expand Down Expand Up @@ -4522,7 +4522,7 @@ The below subsections comprise the current Web Authentication-specific security
## Cryptographic Challenges ## {#cryptographic-challenges}

As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
to avoid replay attacks. Therefore, both {{MakePublicKeyCredentialOptions/challenge}}'s
to avoid replay attacks. Therefore, both {{PublicKeyCredentialCreationOptions/challenge}}'s
and {{PublicKeyCredentialRequestOptions/challenge}}'s value MUST be randomly generated
by [=[RPS]=] in an environment they trust (e.g., on the server-side), and the
returned challenge value in the client's
Expand Down

0 comments on commit ca4cf0f

Please sign in to comment.