Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

undefined terms and terms we really ought to define #462

Open
7 of 33 tasks
equalsJeffH opened this issue May 15, 2017 · 34 comments
Open
7 of 33 tasks

undefined terms and terms we really ought to define #462

equalsJeffH opened this issue May 15, 2017 · 34 comments
Assignees
@nicksteele
Labels
@Risk Items that are at risk for L3 stat:OnGoing type:editorial
Milestone
L3-WD-02

Comments

@equalsJeffH
Copy link
Contributor

equalsJeffH commented May 15, 2017 •
edited by nsatragno
Loading

The below terms are formally undefined and we should consider defining them (and linking their occurrences to their dfn. Be sure to see also issue #358 -- there is overlap between this issue and that one.

Add to, or remove from, this list by updating this original post (OP):

  • attesting authority (aka authenticator vendor (which could be a (client) platform vendor))

  • attestation trust model (presently we discuss "trust model" in terms of attestation types, but do not define the latter term)

  • AAGUID

  • assertion

  • authenticator-related terms:

          authenticator characteristics     // are discussed in #sctn-authenticator-taxonomy
          authenticator session
   cloned authenticator
          authenticator protection measures

  • external authenticator (to be defined in conjunction with roaming authnr)

  • CREDENTIAL:

(a credential)   bound to a authenticator
(a credential is)   bound to   an/this authenticator
                    managed by    "         "
                    controlled by    "         "
                    present on    "         "
                    stored on     "         "
                    owning             authenticator

                     credential ID
                     credential object 
Client-side-resident Public Key Credential Source  //  is presently defined 
                                                   // synonymously with 
                                                   // 'resident credential'
server-side resident credential       // presently undefined

Note: residentKey is currently used in WebIDL (so we're likely stuck with it) and as a variable name in algorithms. It is synonymous with Client-side-resident Public Key Credential Source / resident credential.

CLIENT:

client-side   // see also issue #80

  • cross-platform transport protocols

  • extension data

  • first-factor

    • as in "first-factor authenticator" aka one that is actually multi-factor because it is user verification-capable (1st factor, something you are), and wields the private key (2nd factor, a secret you possess).
    • also may want to clarify/define/use terms such as "multi-factor authn", "first multi-factor", etc.

  • identifier of the credential

supported by this implementation

PLATFORM:

       Android "N" or later platform
                    Android platforms

currently available on this platform
   supported by this client   "
          user agent and/or   "
          as defined by the   "
          overridden by the   "

               the client's   "
                 the client   "
                 the client   "       components

                     user's platform device

                        the platform  makes
                        The   "       is requested

                     Client platforms

                            platform-provided

              script
Relying Party script

  • signature

  • define as "digital signature" ?

  • signature counter

  • supported extensions

  • trust path

  • user/account

    • user
    • user account
    • user's account
    • user's account identifier
    • user account entity
    • user account's PublicKeyCredentialUserEntity.
    • user identifier
    • username

OS level user ID


- [x] user handle

- [ ] webauthn

- [ ] webauthn operations

- [x] Web Authentication
- [ ] Web Authentication protocol
@equalsJeffH equalsJeffH added this to the CR milestone May 15, 2017
@equalsJeffH equalsJeffH self-assigned this May 15, 2017
@equalsJeffH
Copy link
Contributor Author

added to OP yesterday:

AAGUID

authenticator session

extension data

identifier of the credential

supported extensions

user account

webauthn

webauthn operations

@equalsJeffH
Copy link
Contributor Author

equalsJeffH commented May 17, 2017 •
edited
Loading

see also #79 #80 #358

@equalsJeffH equalsJeffH mentioned this issue May 17, 2017
Closed
56 tasks
@equalsJeffH
Copy link
Contributor Author

added to the list in the OP:

attestation statement

@equalsJeffH
Copy link
Contributor Author

removed from list in the OP:

attestation statement -- we do have a dfn (d'oh!): https://w3c.github.io/webauthn/#attestation-statement

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

(a credential)   bound to   an/this authenticator
                 managed by
                 stored on

local configuration knowledge

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

platform-specific API
                  default
                  handle
                  procedure
                  transports

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

cross-platform transport protocols

                            platform
       Android "N" or later platform
                    Android platforms

                        the platform
             the underlying platform
              underlying OS platform

currently available on this platform
   supported by this client   "
          user agent and/or   "
          as defined by the   "
          overridden by the   "

               the client's   "
                 the client   "
                 the client   "       components

                     user's platform device

                        the platform  makes
                        The   "       is requested

                     Client platforms

                            platform-provided

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

signature

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

external authenticator (to be defined in conjunction with roaming authnr)

@AngeloKai
Copy link
Contributor

As discussed on the call, the issue wouldn't change API names. Taking out the renaming flag.

@equalsJeffH
Copy link
Contributor Author

added "first factor" to OP

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

assertion

cloned authenticator

authenticator protection measures

trust path

@AngeloKai AngeloKai modified the milestones: CR, PR Sep 13, 2017
@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

user's account
user's account identifier
user account entity
user account's PublicKeyCredentialUserEntity.

user handle

@equalsJeffH equalsJeffH mentioned this issue Oct 4, 2017
Closed
@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

owning authenticator

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

blinding

@equalsJeffH equalsJeffH mentioned this issue Nov 18, 2017
Closed
@emlun emlun mentioned this issue Mar 9, 2018
Closed
@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

client-side

see also issue #833

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

client            // note "webauthn client" is presently defined
                  // but "webauthn client device" or "webauthn client platform" are not,
                  // and are not presently used, but perhaps should be.

client device     // used a few time
client platform   // used much; see also entries for variations of "platform" below

WebAuthn client

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

LDH Labels (perhaps just make that single-occurrance term a link to https://tools.ietf.org/html/rfc5890#section-2.3.1)

@equalsJeffH
Copy link
Contributor Author

added to list in the OP:

              script
Relying Party script

@YubicoDemo YubicoDemo modified the milestones: PropRec, L2-WD-00 Sep 19, 2018
@equalsJeffH
Copy link
Contributor Author

added to OP:
authenticator characteristics

@emlun
Copy link
Member

emlun commented Nov 27, 2018

Ticked items:

  • external authenticator (to be defined in conjunction with roaming authnr)
  • first factor - as in "first-factor authenticator" aka one that is actually multi-factor because it is user verification-capable (1st factor, something you are), and wields the private key (2nd factor, a secret you possess).
  • scope, as in:
    • Public key credential's scope
    • strong, attested, scoped, public key-based credentials

@equalsJeffH
Copy link
Contributor Author

added to OP:
attestation trust model (presently we discuss "trust model" in terms of attestation types, but do not define the latter term)

@equalsJeffH
Copy link
Contributor Author

Added to OP:

      U2F authenticator
CTAP1/U2F authenticator

@emlun
Copy link
Member

emlun commented Feb 27, 2019

Added to OP:

  • user

See #1162

@equalsJeffH
Copy link
Contributor Author

updated the section on "Credential" to be:

  • CREDENTIAL:
(a credential)   bound to a authenticator
(a credential is)   bound to   an/this authenticator
                    managed by    "         "
                    controlled by    "         "
                    present on    "         "
                    stored on     "         "
                    owning             authenticator

                     credential ID
                     credential object 
Client-side-resident Public Key Credential Source  //  is presently defined 
                                                   // synonymously with 
                                                   // 'resident credential'
server-side resident credential       // presently undefined

Note: residentKey is currently used in WebIDL (so we're likely stuck with it) and as a variable name in algorithms. It is synonymous with Client-side-resident Public Key Credential Source / resident credential.

@equalsJeffH
Copy link
Contributor Author

added to OP:

@equalsJeffH
Copy link
Contributor Author

Punting this onward to L2-WD-02....

@equalsJeffH equalsJeffH modified the milestones: L2-WD-01, L2-WD-02 May 8, 2019
@emlun
Copy link
Member

emlun commented Oct 22, 2019

Checked off:

  • identifier of the credential
  • assertion

@equalsJeffH equalsJeffH modified the milestones: L2-WD-02, L2-WD-03 Nov 6, 2019
@emlun
Copy link
Member

emlun commented Sep 7, 2020

Removed "blinding" from OP as the search term "blind" now produces 0 hits in the editor's draft.

@equalsJeffH equalsJeffH added the stat:puntable Issue or PR that is candidate to move to a later milestone label Oct 13, 2020
@equalsJeffH equalsJeffH modified the milestones: L2-WD-04 Final, L2-CR Nov 11, 2020
@wseltzer wseltzer modified the milestones: L2-CR, L3-WD-01 Feb 18, 2021
@equalsJeffH equalsJeffH removed the stat:puntable Issue or PR that is candidate to move to a later milestone label Mar 17, 2021
@nadalin nadalin added the @Risk Items that are at risk for L3 label Jun 27, 2023
@nadalin nadalin assigned nicksteele and unassigned equalsJeffH Sep 12, 2023
@nicksteele nicksteele mentioned this issue Sep 20, 2023
Merged
@plehegar plehegar modified the milestones: L3-WD-01, L3-WD-02 Oct 4, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees

@nicksteele nicksteele

Labels
@Risk Items that are at risk for L3 stat:OnGoing type:editorial
Projects
None yet
Milestone
L3-WD-02
Development

No branches or pull requests
8 participants
@equalsJeffH @wseltzer @nicksteele @emlun @plehegar @AngeloKai @nadalin @YubicoDemo