added matcherProtection to AuthenticatorSelectionCriteria. See #447

index.bs

@@ -1055,10 +1055,11 @@ associated.
 
 <xmp class="idl">
     dictionary AuthenticatorSelectionCriteria {
-        Attachment    attachment;
-        boolean       requireResidentKey = false;
-        sequence<AAGUID> aaguidList;
-        KeyProtection keyProtection;
+        Attachment        attachment;
+        boolean           requireResidentKey = false;
+        sequence<AAGUID>  aaguidList;
+        KeyProtection     keyProtection;
+        MatcherProtection matcherProtection;
     };
 </xmp>
 
@@ -1081,6 +1082,10 @@ associated.
     ::  If this member is [=present|present=], eligible authenticators are filtered to the ones identified by matching
         the keyProtection method as indicated.
 
+    : <dfn>matcherProtection</dfn>
+    ::  If this member is [=present|present=], eligible authenticators are filtered to the ones identified by matching
+        the matcherProtection method as indicated.
+
 </div>
 
 ### AAGUID (typedef <dfn>AAGUID</dfn>) ### {#aaguid}
@@ -1135,6 +1140,15 @@ use a [=roaming authenticator=] which was originally registered with the [RP] us
        "SE"};  // key protected by a Secure Element
 </pre>
 
+### User Verification Protection enumeration (enum <dfn enum>UserVerificationProtection</dfn>) ### {#user-verification-protection}
+
+<pre class="idl">
+    enum MatcherProtection {
+       "SW",   // user verification protected by Rich-OS software
+       "TEE",  // user verification protected by a Trusted-Execution-Environment
+       "HW"};  // user verification protected by separate HW (e.g. on-chip matcher)
+</pre>
+
 ## Options for Assertion Generation (dictionary <dfn dictionary>PublicKeyCredentialRequestOptions</dfn>) ## {#assertion-options}
 
 The {{PublicKeyCredentialRequestOptions}} dictionary supplies {{CredentialsContainer/get()}} with the data it needs to generate