diff --git a/images/fido-attestation-structures.svg b/images/fido-attestation-structures.svg
index cd28765fb..3f61352d5 100644
--- a/images/fido-attestation-structures.svg
+++ b/images/fido-attestation-structures.svg
@@ -1,13 +1,5 @@
 <?xml version="1.0" encoding="UTF-8" standalone="no"?>
 <svg
-   xmlns:v="http://schemas.microsoft.com/visio/2003/SVGExtensions/"
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
    width="217.147mm"
    height="149.61772mm"
    viewBox="0 0 615.53478 424.11323"
@@ -16,16 +8,48 @@
    version="1.1"
    id="svg4696"
    sodipodi:docname="fido-attestation-structures.svg"
-   inkscape:version="1.0.2 (e86c870879, 2021-01-15, custom)"
-   style="font-size:12px;overflow:visible;color-interpolation-filters:sRGB;fill:none;fill-rule:evenodd;stroke-linecap:square;stroke-miterlimit:3"><metadata
+   inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
+   style="font-size:12px;overflow:visible;color-interpolation-filters:sRGB;fill:none;fill-rule:evenodd;stroke-linecap:square;stroke-miterlimit:3"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:dc="http://purl.org/dc/elements/1.1/"
+   xmlns:v="http://schemas.microsoft.com/visio/2003/SVGExtensions/"><metadata
    id="metadata4702"><rdf:RDF><cc:Work
        rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type
-         rdf:resource="http://purl.org/dc/dcmitype/StillImage" /><dc:title></dc:title></cc:Work></rdf:RDF></metadata><defs
+         rdf:resource="http://purl.org/dc/dcmitype/StillImage" /></cc:Work></rdf:RDF></metadata><defs
    id="defs4700">
 
 
 
 
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
 </defs><sodipodi:namedview
    pagecolor="#ffffff"
    bordercolor="#666666"
@@ -35,20 +59,20 @@
    guidetolerance="10"
    inkscape:pageopacity="0"
    inkscape:pageshadow="2"
-   inkscape:window-width="3840"
-   inkscape:window-height="1992"
+   inkscape:window-width="1584"
+   inkscape:window-height="843"
    id="namedview4698"
    showgrid="false"
    inkscape:snap-to-guides="false"
    inkscape:snap-grids="false"
    showguides="false"
-   inkscape:zoom="2.034231"
-   inkscape:cx="731.47102"
-   inkscape:cy="322.03072"
-   inkscape:window-x="3840"
-   inkscape:window-y="168"
+   inkscape:zoom="1.0784709"
+   inkscape:cx="393.61284"
+   inkscape:cy="332.8787"
+   inkscape:window-x="0"
+   inkscape:window-y="0"
    inkscape:window-maximized="1"
-   inkscape:current-layer="svg4696"
+   inkscape:current-layer="g664"
    inkscape:snap-text-baseline="true"
    fit-margin-top="5"
    fit-margin-left="5"
@@ -56,7 +80,10 @@
    fit-margin-bottom="5"
    inkscape:showpageshadow="false"
    inkscape:document-rotation="0"
-   units="mm" /><v:documentProperties
+   units="mm"
+   inkscape:pagecheckerboard="0"
+   inkscape:deskcolor="#d1d1d1"
+   inkscape:document-units="mm" /><v:documentProperties
    v:langID="1031"
    v:metric="true"
    v:viewMarkup="false"><v:userDefs><v:ud
@@ -80,34 +107,14 @@
 		.st11 {fill:none;stroke:#000000;stroke-width:0.25}
 		.st12 {font-size:1em}
 		.st13 {fill:none;fill-rule:evenodd;font-size:12px;overflow:visible;stroke-linecap:square;stroke-miterlimit:3}
-	</style><g
-   transform="matrix(1,0,0,0.92145913,244.58396,-515.9201)"
-   v:groupContext="shape"
-   v:mID="4"
-   id="shape4-1"><title
-   id="title4223">Tabelle.4</title><desc
-   id="desc4225">ATTESTATION OBJECT</desc><v:textBlock
-   v:tabSpace="42.5197"
-   v:margins="rect(4,4,4,4)" /><v:textRect
-   height="20"
-   width="152.01"
-   cy="585.276"
-   cx="76" /><rect
-   style="fill:none;stroke:none;stroke-width:0.25"
-   id="rect4227"
-   class="st1"
-   height="20"
-   width="152"
-   y="575.276"
-   x="0" /><text
-   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:11.4592px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start;fill:#000000"
+	</style><text
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:11px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:center;writing-mode:lr-tb;text-anchor:middle;fill:#000000;stroke-width:0.959927"
    id="text4229"
    v:langID="1031"
    class="st2"
-   y="588.28003"
-   x="4"><v:paragraph /><v:tabList />ATTESTATION OBJECT</text>
-
-</g>
+   y="27.247816"
+   x="295.49463"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />ATTESTATION OBJECT</text>
 
 
 
@@ -116,17 +123,17 @@
    transform="translate(-10.919486,4.580723)"><g
      transform="translate(382.09791,-8.0817938)"
      id="g4727"><text
-   x="78.588913"
+   x="112.84915"
    y="62.388382"
    class="st2"
    v:langID="1031"
    id="text4549"
-   style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000"
+   style="font-size:9.5993px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"
    transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />“<tspan
    class="st12"
    v:langID="1033"
    id="tspan4547"
-   style="font-size:9.5993px">authData</tspan>“:   ...</text>
+   style="font-size:9.5993px;text-align:center;text-anchor:middle">authData</tspan>“:   ...</text>
 <rect
    x="4.8172159"
    y="46.116562"
@@ -134,139 +141,42 @@
    height="20.896112"
    class="st11"
    id="rect4556"
-   style="fill:none;stroke:#000000;stroke-width:0.96;stroke-miterlimit:3;stroke-dasharray:none" /></g><g
-     transform="translate(-212.47294,5.4747629)"
-     id="g4734"><rect
-   x="238.04565"
-   y="32.560005"
-   width="101.417"
-   height="20.896112"
-   class="st11"
-   id="rect4545"
-   style="fill:none;stroke:#000000;stroke-width:0.96;stroke-miterlimit:3;stroke-dasharray:none" /><text
-   x="237.49796"
-   y="47.686531"
-   class="st2"
-   v:langID="1031"
-   id="text4564"
-   style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000"
-   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />“fmt“:   “packed“</text>
-<rect
-   x="339.46362"
-   y="32.560005"
-   width="259.92441"
-   height="20.896112"
-   class="st11"
-   id="rect4571"
-   style="fill:none;stroke:#000000;stroke-width:0.96;stroke-miterlimit:3;stroke-dasharray:none" /><text
-   x="429.00137"
-   y="47.686501"
-   class="st2"
-   v:langID="1031"
-   id="text4575"
-   style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000"
-   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />“<tspan
+   style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-miterlimit:3;stroke-dasharray:none" /></g><g
+     id="g3405"><rect
+       x="25.572714"
+       y="38.034767"
+       width="101.417"
+       height="20.896112"
+       class="st11"
+       id="rect4545"
+       style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-miterlimit:3;stroke-dasharray:none" /><text
+       x="73.224365"
+       y="53.389847"
+       class="st2"
+       v:langID="1031"
+       id="text4564"
+       style="font-size:9.5993px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"
+       transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />“fmt“:   “packed“</text></g><g
+     id="g3410"><rect
+       x="126.99068"
+       y="38.034767"
+       width="259.92441"
+       height="20.896112"
+       class="st11"
+       id="rect4571"
+       style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-miterlimit:3;stroke-dasharray:none" /><text
+       x="246.94389"
+       y="53.389816"
+       class="st2"
+       v:langID="1031"
+       id="text4575"
+       style="font-size:9.5993px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"
+       transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />“<tspan
    class="st12"
    v:langID="1033"
    id="tspan4573"
-   style="font-size:9.5993px">attStmt</tspan>“:   ...</text>
-</g></g>
-<g
-   id="g1553"
-   transform="translate(-33.118635,9.0126739)"><g
-     id="g10917"
-     transform="translate(-84.919659,-9.228886)"><g
-       id="shape60-158"
-       v:mID="60"
-       v:groupContext="shape"
-       transform="matrix(1,0,0,0.92145913,291.99378,-157.28339)"><title
-   id="title4606">Rechteck.3</title><desc
-   id="desc4608">“sig“: ...</desc><v:userDefs><v:ud
-     v:nameU="visVersion"
-     v:val="VT0(15):26" /></v:userDefs><v:textBlock
-   v:margins="rect(4,4,4,4)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="50.7087"
-   cy="583.937"
-   width="101.42"
-   height="22.6772" /><rect
-   x="0"
-   y="572.59802"
-   width="101.417"
-   height="22.6772"
-   class="st11"
-   id="rect4610"
-   style="fill:none;stroke:#000000;stroke-width:0.25" /><text
-   x="4"
-   y="586.94"
-   class="st2"
-   v:langID="1031"
-   id="text4612"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />“sig“:   ...</text>
+   style="font-size:9.5993px;text-align:center;text-anchor:middle">attStmt</tspan>“:   ...</text></g></g>
 
-</g><g
-       id="shape61-161"
-       v:mID="61"
-       v:groupContext="shape"
-       transform="matrix(1,0,0,0.92145913,190.57678,-157.28339)"><title
-   id="title4615">Rechteck.5</title><desc
-   id="desc4617">“alg“: ...</desc><v:userDefs><v:ud
-     v:nameU="visVersion"
-     v:val="VT0(15):26" /></v:userDefs><v:textBlock
-   v:margins="rect(4,4,4,4)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="50.7087"
-   cy="583.937"
-   width="101.42"
-   height="22.6772" /><rect
-   x="0"
-   y="572.59802"
-   width="101.417"
-   height="22.6772"
-   class="st11"
-   id="rect4619"
-   style="fill:none;stroke:#000000;stroke-width:0.25" /><text
-   x="4"
-   y="586.94"
-   class="st2"
-   v:langID="1031"
-   id="text4623"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />“alg<tspan
-   class="st12"
-   v:langID="1033"
-   id="tspan4621"
-   style="font-size:10px">“</tspan>:   ...</text>
-
-</g></g><g
-     transform="matrix(1,0,0,0.92145913,308.49212,-166.51228)"
-     v:groupContext="shape"
-     v:mID="62"
-     id="shape62-165"><title
-   id="title4626">Rechteck.6</title><desc
-   id="desc4628">“x5c“: ...</desc><v:userDefs><v:ud
-     v:val="VT0(15):26"
-     v:nameU="visVersion" /></v:userDefs><v:textBlock
-   v:tabSpace="42.5197"
-   v:margins="rect(4,4,4,4)" /><v:textRect
-   height="22.6772"
-   width="101.42"
-   cy="583.937"
-   cx="50.7087" /><rect
-   style="fill:none;stroke:#000000;stroke-width:0.25"
-   id="rect4630"
-   class="st11"
-   height="22.6772"
-   width="101.417"
-   y="572.59802"
-   x="0" /><text
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"
-   id="text4632"
-   v:langID="1031"
-   class="st2"
-   y="586.94"
-   x="4"><v:paragraph /><v:tabList />“x5c“:   ...</text>
-
-</g></g>
 
 
 
@@ -277,821 +187,104 @@
      inkscape:connector-curvature="0"
      id="path10821"
      d="M 116.9284,52.899909 C 75.853189,84.36875 15.887261,57.101096 15.887261,81.894736"
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.621277px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /><path
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.690744px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.30115009;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none" /><path
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.30115009;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none"
      d="M 116.9284,52.899909 C 189.01472,98.834631 521.89607,40.639793 520.23253,84.440991"
      id="path10823"
      inkscape:connector-curvature="0"
      sodipodi:nodetypes="cc" /></g><g
    id="g4988"
-   transform="translate(58.948918,20.744309)"><g
-   id="shape7-4"
-   v:mID="7"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,81.598191,-347.31762)"><title
-     id="title4232">rect40</title><rect
-     x="0"
-     y="572.047"
-     width="136.063"
-     height="23.2281"
-     class="st3"
-     id="rect4234"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape8-6"
-   v:mID="8"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,693.88219,179.80122)"><title
-     id="title4237">line42</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4239"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape9-9"
-   v:mID="9"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,693.88219,196.92378)"><title
-     id="title4242">line44</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4244"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape10-12"
-   v:mID="10"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,710.89019,179.80122)"><title
-     id="title4247">line46</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4249"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape11-15"
-   v:mID="11"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,710.89019,196.92378)"><title
-     id="title4252">line48</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4254"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape12-18"
-   v:mID="12"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,727.89819,179.80122)"><title
-     id="title4257">line50</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4259"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape13-21"
-   v:mID="13"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,727.89819,196.92378)"><title
-     id="title4262">line52</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4264"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape14-24"
-   v:mID="14"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,744.90519,179.80122)"><title
-     id="title4267">line54</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4269"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape15-27"
-   v:mID="15"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,744.90519,196.92378)"><title
-     id="title4272">line56</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4274"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape16-30"
-   v:mID="16"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,761.91319,179.80122)"><title
-     id="title4277">line58</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4279"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape17-33"
-   v:mID="17"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,761.91319,196.92378)"><title
-     id="title4282">line60</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4284"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape18-36"
-   v:mID="18"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,778.92119,179.80122)"><title
-     id="title4287">line62</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4289"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape19-39"
-   v:mID="19"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,778.92119,196.92378)"><title
-     id="title4292">line64</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4294"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape20-42"
-   v:mID="20"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,795.92919,179.80122)"><title
-     id="title4297">line66</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4299"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape21-45"
-   v:mID="21"
-   v:groupContext="shape"
-   transform="matrix(0,0.92145913,-1,0,795.92919,196.92378)"><title
-     id="title4302">line68</title><path
-     d="M 0,595.28 H 4.65"
-     class="st4"
-     id="path4304"
-     inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><rect
+   transform="translate(58.948918,20.744309)"><rect
    style="fill:none;stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round"
    id="rect4309"
    class="st3"
    height="20.896112"
    width="115.417"
+   y="134.39268"
+   x="13.704551" /><rect
+   x="129.12215"
    y="134.55392"
-   x="13.704551" /><g
-   id="shape23-50"
-   v:mID="23"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,39.849051,-397.06996)"><title
-   id="title4312">text72</title><desc
-   id="desc4314">RP ID hash</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="50.025"
-   cy="589.276"
-   width="100.05"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="100.05"
-   height="12"
-   class="st5"
-   id="rect4316"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.28003"
-   class="st2"
-   v:langID="1031"
-   id="text4318"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />RP ID hash</text>
-
-</g><g
-   id="shape24-53"
-   v:mID="24"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,129.12215,-393.07175)"><title
-     id="title4321">rect76</title><rect
-     x="0"
-     y="572.59802"
-     width="45.354301"
-     height="22.6772"
-     class="st3"
-     id="rect4323"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape25-55"
-   v:mID="25"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,135.84915,-397.06996)"><title
-   id="title4326">text78</title><desc
-   id="desc4328">FLAGS</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="25.025"
-   cy="589.276"
-   width="50.05"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="50.049999"
-   height="12"
-   class="st5"
-   id="rect4330"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.28003"
-   class="st2"
-   v:langID="1031"
-   id="text4332"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />FLAGS</text>
-
-</g><g
-   id="shape26-58"
-   v:mID="26"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,121.58719,-352.57086)"><title
-   id="title4335">text82</title><desc
-   id="desc4337">0</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="4.525"
-   cy="589.876"
-   width="9.05"
-   height="10.8" /><rect
-   x="0"
-   y="584.47601"
-   width="9.0500002"
-   height="10.8"
-   class="st5"
-   id="rect4339"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.58002"
-   class="st6"
-   v:langID="1031"
-   id="text4341"
-   style="font-size:9px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />0</text>
-
-</g><g
-   id="shape27-61"
-   v:mID="27"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,138.59519,-352.57086)"><title
-   id="title4344">text86</title><desc
-   id="desc4346">0</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="4.525"
-   cy="589.876"
-   width="9.05"
-   height="10.8" /><rect
-   x="0"
-   y="584.47601"
-   width="9.0500002"
-   height="10.8"
-   class="st5"
-   id="rect4348"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.58002"
-   class="st6"
-   v:langID="1031"
-   id="text4350"
-   style="font-size:9px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />0</text>
-
-</g><g
-   id="shape28-64"
-   v:mID="28"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,155.60319,-352.57086)"><title
-   id="title4353">text90</title><desc
-   id="desc4355">0</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="4.525"
-   cy="589.876"
-   width="9.05"
-   height="10.8" /><rect
-   x="0"
-   y="584.47601"
-   width="9.0500002"
-   height="10.8"
-   class="st5"
-   id="rect4357"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.58002"
-   class="st6"
-   v:langID="1031"
-   id="text4359"
-   style="font-size:9px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />0</text>
-
-</g><rect
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt"
-   id="rect4366"
-   class="st5"
-   height="9.9517584"
-   width="9.0500002"
-   y="185.99989"
-   x="172.61119" /><text
-   transform="scale(1.0417463,0.95992662)"
-   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:9px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start;fill:#000000"
-   id="text4368"
-   v:langID="1031"
-   class="st6"
-   y="202.12334"
-   x="161.42305"><v:paragraph /><v:tabList /><tspan
-     style="font-size:8.6393px;line-height:1.25"
-     y="202.12334"
-     x="161.42305"
-     id="tspan4132"
-     sodipodi:role="line">UV</tspan></text>
-<g
-   id="shape30-70"
-   v:mID="30"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,189.61919,-352.57086)"><title
-   id="title4371">text98</title><desc
-   id="desc4373">0</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="4.525"
-   cy="589.876"
-   width="9.05"
-   height="10.8" /><rect
-   x="0"
-   y="584.47601"
-   width="9.0500002"
-   height="10.8"
-   class="st5"
-   id="rect4375"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.58002"
-   class="st6"
-   v:langID="1031"
-   id="text4377"
-   style="font-size:9px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />0</text>
-
-</g><g
-   id="shape31-73"
-   v:mID="31"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,101.16419,-352.57086)"><title
-   id="title4380">text102</title><desc
-   id="desc4382">AT</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="9.025"
-   cy="589.876"
-   width="18.05"
-   height="10.8" /><rect
-   x="0"
-   y="584.47601"
-   width="18.049999"
-   height="10.8"
-   class="st5"
-   id="rect4384"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.58002"
-   class="st6"
-   v:langID="1031"
-   id="text4386"
-   style="font-size:9px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />AT</text>
-
-</g><g
-   id="shape32-76"
-   v:mID="32"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,84.156191,-352.39118)"><title
-   id="title4389">text106</title><desc
-   id="desc4391">ED</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="9.025"
-   cy="589.876"
-   width="18.05"
-   height="10.8" /><rect
-   x="0"
-   y="584.47601"
-   width="18.049999"
-   height="10.8"
-   class="st5"
-   id="rect4393"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.58002"
-   class="st6"
-   v:langID="1031"
-   id="text4395"
-   style="font-size:9px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />ED</text>
-
-</g><rect
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt"
-   id="rect4402"
-   class="st5"
-   height="8.8460083"
-   width="24.049999"
-   y="186.59517"
-   x="201.36018" /><text
-   transform="scale(1.0417463,0.95992662)"
-   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7.99997px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start;fill:#000000"
-   id="text4404"
-   v:langID="1031"
-   class="st7"
-   y="200.72075"
-   x="194.89264"><v:paragraph /><v:tabList /><tspan
-     style="font-size:7.6794px;line-height:1.25"
-     sodipodi:role="line"
-     id="tspan4126"
-     x="194.89264"
-     y="200.72075">UP</tspan></text>
-<g
-   id="shape34-82"
-   v:mID="34"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,174.47615,-393.07175)"><title
-     id="title4407">rect114</title><rect
-     x="0"
-     y="572.59802"
-     width="101.417"
-     height="22.6772"
-     class="st3"
-     id="rect4409"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape35-84"
-   v:mID="35"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,201.18015,-397.06996)"><title
-   id="title4412">text116</title><desc
-   id="desc4414">COUNTER</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="35.025"
-   cy="589.276"
-   width="70.06"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="70.050003"
-   height="12"
-   class="st5"
-   id="rect4416"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.28003"
-   class="st2"
-   v:langID="1031"
-   id="text4418"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />COUNTER</text>
-
-</g><g
-   id="shape36-87"
-   v:mID="36"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,275.89315,-393.07175)"><title
-     id="title4421">rect120</title><rect
-     x="0"
-     y="572.59802"
-     width="130"
-     height="22.6772"
-     class="st3"
-     id="rect4423"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape37-89"
-   v:mID="37"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,290.18015,-397.06996)"><title
-   id="title4426">text122</title><desc
-   id="desc4428">ATTESTATION DATA</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="80.025"
-   cy="589.276"
-   width="160.06"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="160.05"
-   height="12"
-   class="st5"
-   id="rect4430"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="-6"
-   y="592.28003"
-   class="st2"
-   v:langID="1031"
-   id="text4432"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />ATTESTED CRED. DATA</text>
+   width="45.354301"
+   height="20.896112"
+   class="st3"
+   id="rect4323"
+   style="fill:none;stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" />
 
-</g><rect
+<rect
+   x="174.47615"
+   y="134.55392"
+   width="101.417"
+   height="20.896112"
+   class="st3"
+   id="rect4409"
+   style="fill:none;stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><rect
+   x="275.89316"
+   y="134.55392"
+   width="130"
+   height="20.896112"
+   class="st3"
+   id="rect4423"
+   style="fill:none;stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><rect
    style="fill:none;stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round"
    id="rect4437"
    class="st3"
    height="20.896112"
    width="134.47066"
    y="134.55394"
-   x="405.89316" /><g
-   id="shape39-94"
-   v:mID="39"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,434.48715,-397.06996)"><title
-   id="title4440">text128</title><desc
-   id="desc4442">EXTENSIONS</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="50.025"
-   cy="589.276"
-   width="100.05"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="100.05"
-   height="12"
-   class="st5"
-   id="rect4444"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.28003"
-   class="st2"
-   v:langID="1031"
-   id="text4446"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />EXTENSIONS</text>
-
-</g><g
-   id="shape40-97"
-   v:mID="40"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,504.94815,-390.46033)"><title
-     id="title4449">path132</title><path
-     d="m 0,566.93 2.83,9.45 -2.83,9.45 2.83,9.45 H 8.5 l -2.83,-9.45 2.83,-9.45 -2.83,-9.45 z"
+   x="405.89313" /><g
+   id="g2576"
+   transform="translate(13.5)"><path
+     d="m 504.94815,131.94249 2.83,8.70779 -2.83,8.70779 2.83,8.70779 h 5.67 l -2.83,-8.70779 2.83,-8.70779 -2.83,-8.70779 z"
      class="st8"
      id="path4451"
      inkscape:connector-curvature="0"
-     style="fill:#ffffff;stroke:none;stroke-width:1;stroke-linecap:butt" /></g><g
-   id="shape41-99"
-   v:mID="41"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,504.94815,-390.46033)"><title
-     id="title4454">path134</title><path
-     d="m 0,566.93 2.83,9.45 -2.83,9.45 2.83,9.45 z"
-     class="st9"
-     id="path4456"
-     inkscape:connector-curvature="0"
-     style="fill:none" /><path
-     d="m 0,566.93 2.83,9.45 -2.83,9.45 2.83,9.45"
+     style="fill:#ffffff;stroke:none;stroke-width:0.959927;stroke-linecap:butt" /><path
+     d="m 504.94815,131.94249 2.83,8.70779 -2.83,8.70779 2.83,8.70779"
      class="st4"
      id="path4458"
      inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape42-102"
-   v:mID="42"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,510.61815,-390.46033)"><title
-     id="title4461">path136</title><path
-     d="m 0,566.93 2.83,9.45 -2.83,9.45 2.83,9.45 z"
-     class="st9"
-     id="path4463"
-     inkscape:connector-curvature="0"
-     style="fill:none" /><path
-     d="m 0,566.93 2.83,9.45 -2.83,9.45 2.83,9.45"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 510.61815,131.94249 2.83,8.70779 -2.83,8.70779 2.83,8.70779"
      class="st4"
      id="path4465"
      inkscape:connector-curvature="0"
-     style="stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape43-105"
-   v:mID="43"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,43.313954,-415.03209)"><title
-   id="title4468">text138</title><desc
-   id="desc4470">32 bytes</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="32.025"
-   cy="590.476"
-   width="64.05"
-   height="9.6" /><rect
-   x="0"
-   y="585.67603"
-   width="64.050003"
-   height="9.6000004"
-   class="st5"
-   id="rect4472"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.88"
-   class="st7"
-   v:langID="1031"
-   id="text4474"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />32 bytes</text>
-
-</g><g
-   id="shape44-108"
-   v:mID="44"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,139.20682,-414.47593)"><title
-   id="title4477">text142</title><desc
-   id="desc4479">1 byte</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="24.025"
-   cy="590.476"
-   width="48.05"
-   height="9.6" /><rect
-   x="0"
-   y="585.67603"
-   width="48.049999"
-   height="9.6000004"
-   class="st5"
-   id="rect4481"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="592.88"
-   class="st7"
-   v:langID="1031"
-   id="text4483"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />1 byte</text>
-
-</g><g
-   id="shape45-111"
-   v:mID="45"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,174.58115,-414.47593)"><title
-   id="title4486">text146</title><desc
-   id="desc4488">4 bytes (big-endian uint32)</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="108.025"
-   cy="590.476"
-   width="216.06"
-   height="9.6" /><rect
-   x="0"
-   y="585.67603"
-   width="216.05"
-   height="9.6000004"
-   class="st5"
-   id="rect4490"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="6.6739964"
-   y="593.48358"
-   class="st7"
-   v:langID="1031"
-   id="text4492"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000">4 bytes <tspan
-   id="tspan4017"
-   style="font-size:6.25048px">(big-endian uint32)</tspan><v:paragraph /><v:tabList /></text>
-
-</g><g
-   id="shape46-114"
-   v:mID="46"
-   v:groupContext="shape"
-   transform="matrix(0.94538871,0,0,0.92145913,287.05365,-413.91976)"><title
-   id="title4495">text150</title><desc
-   id="desc4497">variable length (if present)</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="112.025"
-   cy="590.476"
-   width="224.06"
-   height="9.6" /><rect
-   x="0"
-   y="585.67603"
-   width="224.05"
-   height="9.6000004"
-   class="st5"
-   id="rect4499"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="26.473223"
-   y="592.27643"
-   class="st7"
-   v:langID="1031"
-   id="text4501"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />variable length </text>
-
-</g><g
-   id="shape47-117"
-   v:mID="47"
-   v:groupContext="shape"
-   transform="matrix(0.99992555,0.01220251,-0.01124411,0.92139052,417.65907,-414.95338)"><title
-   id="title4504">text154</title><desc
-   id="desc4506">variable length (CBOR)</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="88.025"
-   cy="590.476"
-   width="176.05"
-   height="9.6" /><text
-   x="-1.6683749"
-   y="592.9021"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /></g><text
+   x="455.75177"
+   y="126.86462"
    class="st7"
    v:langID="1031"
    id="text4510"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />variable length if present (CBOR)</text>
-
-</g><g
-   id="shape51-129"
-   v:mID="51"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,80.348021,-337.06245)"><title
-   id="title4532">text166</title><desc
-   id="desc4534">7</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="3.525"
-   cy="591.076"
-   width="7.06"
-   height="8.4" /><rect
-   x="0"
-   y="586.87598"
-   width="7.0500002"
-   height="8.3999996"
-   class="st5"
-   id="rect4536"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="0"
-   y="593.17999"
-   class="st10"
-   v:langID="1031"
-   id="text4538"
-   style="font-size:6.99994px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />7</text>
-
-</g><text
-   transform="scale(0.99080456,1.0092808)"
-   style="font-size:10.0928px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:1.00928"
+   style="font-size:7.67938px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:0.959927"
+   transform="matrix(1.0416687,0.01271192,-0.01171351,0.95985518,0,0)"><v:paragraph /><v:tabList />variable length if present (CBOR)</text><text
+   transform="scale(0.99080455,1.0092808)"
+   style="font-size:10.0928px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:1.00928"
    id="text4594"
    v:langID="1031"
    class="st2"
    y="110.54917"
-   x="183.11613"><v:paragraph /><v:tabList />AUTHENTICATOR DATA</text>
-<flowRoot
-   transform="matrix(1,0,0,0.92145913,487.04245,-130.03124)"
-   style="font-style:normal;font-weight:normal;line-height:0.01%;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-   id="flowRoot3695"
-   xml:space="preserve"><flowRegion
-     id="flowRegion3697"><rect
-       y="279.22159"
-       x="9.7329111"
-       height="72.996834"
-       width="684.77985"
-       id="rect3699" /></flowRegion><flowPara
-     id="flowPara3701"
-     style="font-size:40px;line-height:1.25"> </flowPara></flowRoot><g
-   id="shape36-87-1"
-   v:mID="36"
-   v:groupContext="shape"
-   transform="matrix(0.62480125,0,0,0.92585265,183.77398,-272.76165)"><title
-     id="title4421-4">rect120</title><rect
-     x="0"
-     y="572.59802"
-     width="130"
-     height="22.6772"
-     class="st3"
-     id="rect4423-0"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape39-94-5"
-   v:mID="39"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,219.06021,-275.27595)"><title
-   id="title4440-5">text128</title><desc
-   id="desc4442-7">EXTENSIONS</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="50.025"
-   cy="589.276"
-   width="100.05"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="100.05"
-   height="12"
-   class="st5"
-   id="rect4444-7"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="-8.4613819"
-   y="592.28003"
+   x="269.99509"><v:paragraph /><v:tabList />AUTHENTICATOR DATA</text>
+<rect
+   x="183.77399"
+   y="257.87006"
+   width="81.224159"
+   height="20.799112"
+   class="st3"
+   id="rect4423-0"
+   style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" /><text
+   x="215.68694"
+   y="282.89581"
    class="st2"
    v:langID="1031"
    id="text4446-3"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000">AAGUID<v:paragraph /><v:tabList /></text>
-
-</g><g
-   id="shape36-87-1-3"
-   v:mID="36"
-   v:groupContext="shape"
-   transform="matrix(0.17344679,0,0,0.93370993,264.93298,-277.34982)"><title
-     id="title4421-4-1">rect120</title><rect
-     x="0"
-     y="572.59802"
-     width="130"
-     height="22.6772"
-     class="st3"
-     id="rect4423-0-9"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><text
+   style="font-size:9.59927px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:0.959927"
+   transform="scale(1.0417463,0.95992662)">AAGUID<v:paragraph /><v:tabList /></text><rect
+   x="264.93298"
+   y="257.871"
+   width="22.548082"
+   height="20.797207"
+   class="st3"
+   id="rect4423-0-9"
+   style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" /><text
    xml:space="preserve"
    style="font-style:normal;font-weight:normal;line-height:0%;font-family:sans-serif;letter-spacing:0px;word-spacing:0px;fill:#000000;fill-opacity:1;stroke:none;stroke-width:0.781311"
    x="278.23788"
@@ -1102,187 +295,90 @@
      x="278.23788"
      y="99.178825"
      style="font-size:30px;line-height:19.5328;stroke-width:0.781311"> </tspan></text>
-<g
-   id="shape39-94-5-3"
-   v:mID="39"
-   v:groupContext="shape"
-   transform="matrix(1.0318156,0,0,0.92145913,278.1943,-274.95641)"><title
-   id="title4440-5-7">text128</title><desc
-   id="desc4442-7-7">EXTENSIONS</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="50.025"
-   cy="589.276"
-   width="100.05"
-   height="12" /><rect
-   x="0"
-   y="583.276"
-   width="100.05"
-   height="12"
-   class="st5"
-   id="rect4444-7-5"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="-5.8172002"
-   y="592.85394"
+<text
+   x="260.66772"
+   y="287.36081"
    class="st2"
    v:langID="1031"
    id="text4446-3-7"
-   style="font-size:10px;line-height:0%;font-family:Calibri;fill:#000000">L<v:paragraph /><v:tabList /></text>
-
-</g><g
-   id="shape36-87-4"
-   v:mID="36"
-   v:groupContext="shape"
-   transform="matrix(0.61988331,0,0,0.92594885,287.39369,-272.96702)"><title
-     id="title4421-1">rect120</title><rect
-     x="0"
-     y="572.59802"
-     width="130"
-     height="22.6772"
-     class="st3"
-     id="rect4423-5"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><text
+   style="font-size:9.75077px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:0.975077"
+   transform="scale(1.0581884,0.9450113)">L<v:paragraph /><v:tabList /></text><rect
+   x="287.39368"
+   y="257.87006"
+   width="80.584831"
+   height="20.799089"
+   class="st3"
+   id="rect4423-5"
+   style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" /><text
    transform="scale(1.0417463,0.95992662)"
-   style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000"
+   style="font-size:9.5993px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"
    id="text4446-3-1"
    v:langID="1031"
    class="st2"
-   y="282.71841"
-   x="277.6377">CREDENTIAL ID<v:paragraph /><v:tabList /></text>
+   y="282.89581"
+   x="314.5546">CREDENTIAL ID<v:paragraph /><v:tabList /></text>
 <text
    transform="scale(1.0417463,0.95992662)"
-   style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:1"
+   style="font-size:9.5993px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:1"
    id="text4446-3-1-9"
    v:langID="1031"
    class="st2"
    y="282.89581"
-   x="356.25369">CREDENTIAL PUBLIC KEY<v:paragraph /><v:tabList /></text>
-<g
-   id="shape36-87-9"
-   v:mID="36"
-   v:groupContext="shape"
-   transform="matrix(1.0000627,0,0,0.92146272,367.96197,-270.41437)"><title
-     id="title4421-5">rect120</title><rect
-     x="0"
-     y="572.59802"
-     width="130"
-     height="22.6772"
-     class="st3"
-     id="rect4423-8"
-     style="fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round" /></g><g
-   id="shape47-117-2"
-   v:mID="47"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,306.4357,-257.27537)"><title
-   id="title4504-4">text154</title><desc
-   id="desc4506-6">variable length (CBOR)</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="88.025"
-   cy="590.476"
-   width="176.05"
-   height="9.6" /><rect
-   x="0"
-   y="585.67603"
-   width="176.05"
-   height="9.6000004"
-   class="st5"
-   id="rect4508-4"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="75.822388"
-   y="591.02393"
+   x="415.32285">CREDENTIAL PUBLIC KEY<v:paragraph /><v:tabList /></text>
+<rect
+   x="367.96198"
+   y="257.87006"
+   width="130.00815"
+   height="20.79911"
+   class="st3"
+   id="rect4423-8"
+   style="fill:none;stroke:#000000;stroke-width:0.47905511;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" /><text
+   x="415.76923"
+   y="299.32394"
    class="st7"
    v:langID="1031"
    id="text4510-3"
-   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7.99997px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start;fill:#000000"><v:paragraph /><v:tabList /><tspan
-     style="font-size:7.99999px;line-height:1.25"
-     y="591.02393"
-     x="75.822388"
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7.67938px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:center;writing-mode:lr-tb;text-anchor:middle;fill:#000000;stroke-width:0.959927"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList /><tspan
+     style="font-size:7.67938px;line-height:1.25;text-align:center;text-anchor:middle;stroke-width:0.959927"
+     y="299.32394"
+     x="415.76923"
      id="tspan4137"
-     sodipodi:role="line">variable length (COSE_Key)</tspan></text>
-
-<text
-   x="-1.9327474"
-   y="591.29724"
+     sodipodi:role="line">variable length (COSE_Key)</tspan></text><text
+   x="314.55453"
+   y="299.32401"
    class="st7"
    v:langID="1031"
    id="text4510-3-9"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:1"><v:paragraph /><v:tabList />LENGTH L </text>
-
-<text
-   x="-11.054238"
-   y="599.9588"
-   class="st7"
-   v:langID="1031"
-   id="text4510-3-5"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:1"><v:paragraph /><v:tabList />(variable length)</text>
-
-</g><g
-   id="shape44-108-3"
-   v:mID="44"
-   v:groupContext="shape"
-   transform="matrix(1,0,0,0.92145913,222.92083,-246.40181)"><title
-   id="title4477-0">text142</title><desc
-   id="desc4479-0">1 byte</desc><v:textBlock
-   v:margins="rect(0,0,0,0)"
-   v:tabSpace="42.5197" /><v:textRect
-   cx="24.025"
-   cy="590.476"
-   width="48.05"
-   height="9.6" /><rect
-   x="0"
-   y="585.67603"
-   width="48.049999"
-   height="9.6000004"
-   class="st5"
-   id="rect4481-4"
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt" /><text
-   x="39.336426"
-   y="578.03156"
+   style="font-size:7.67938px;line-height:100%;font-family:Calibri;fill:#000000;stroke-width:0.959927"
+   transform="scale(1.0417465,0.95992644)"><tspan
+     x="314.55453"
+     y="299.32401"
+     sodipodi:role="line"
+     id="tspan4345"
+     style="text-align:center;text-anchor:middle;stroke-width:0.959927">L bytes</tspan><tspan
+     x="314.55453"
+     y="307.00339"
+     sodipodi:role="line"
+     style="text-align:center;text-anchor:middle;stroke-width:0.959927"
+     id="tspan4349">(variable length)</tspan></text><text
+   x="265.12695"
+   y="299.32394"
    class="st7"
    v:langID="1031"
    id="text4483-1"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000"><v:paragraph /><v:tabList />2 bytes</text>
-
-<text
-   x="-13.980482"
-   y="578.25598"
+   style="font-size:7.67938px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:0.959927"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />2 bytes</text><text
+   x="215.2252"
+   y="299.32394"
    class="st7"
    v:langID="1031"
    id="text4483-1-9"
-   style="font-size:7.99997px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:1"><v:paragraph /><v:tabList />16 bytes</text>
-
-</g><g
-   transform="matrix(1,0,0,0.92145913,212.71563,-439.39706)"
-   v:groupContext="shape"
-   v:mID="51"
-   id="g4007"><title
-   id="title4009">text166</title><desc
-   id="desc4011">7</desc><v:textBlock
-   v:tabSpace="42.5197"
-   v:margins="rect(0,0,0,0)" /><v:textRect
-   height="8.4"
-   width="7.06"
-   cy="591.076"
-   cx="3.525" /><rect
-   style="fill:none;stroke:none;stroke-width:0.75;stroke-linecap:butt"
-   id="rect4013"
-   class="st5"
-   height="8.3999996"
-   width="7.0500002"
-   y="697.32953"
-   x="3.8931646" /><text
-   style="font-size:6.99994px;line-height:0%;font-family:Calibri;fill:#000000"
-   id="text4015"
-   v:langID="1031"
-   class="st10"
-   y="703.63354"
-   x="3.8931646">0<v:paragraph /><v:tabList /></text>
-
-</g><g
+   style="font-size:7.67938px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:0.959927"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />16 bytes</text><g
    transform="translate(1.6684991,5.5616637)"
    id="g10865"><path
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.8px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none"
      d="m 339.23821,172.20997 c -19.66726,-18.35349 -63.91861,0 -63.91861,-14.46033"
      id="path10801"
      inkscape:connector-curvature="0"
@@ -1291,15 +387,15 @@
      inkscape:connector-curvature="0"
      id="path10803"
      d="m 339.72812,172.20997 c 19.66726,-18.35349 63.91861,0 63.91861,-14.46033"
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.8px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /></g><g
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none" /></g><g
    transform="translate(1.6684991,5.5616637)"
    id="g10861"><path
      sodipodi:nodetypes="cc"
      inkscape:connector-curvature="0"
      id="path10815"
      d="m 339.71567,231.42849 c -48.31052,18.35349 -157.00923,0 -157.00923,14.46033"
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.8px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /><path
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.8px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none" /><path
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none"
      d="m 339.71567,231.42849 c 48.31053,18.35349 158.21264,0 158.21264,14.46033"
      id="path10817"
      inkscape:connector-curvature="0"
@@ -1310,8 +406,8 @@
      inkscape:connector-curvature="0"
      id="path10829"
      d="m 149.28306,154.12136 c -21.62209,18.35349 -70.271803,0 -70.271803,14.46033"
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.8px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /><path
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.8px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none" /><path
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none"
      d="m 149.82166,154.12136 c 21.62209,18.35349 70.2718,0 70.2718,14.46033"
      id="path10831"
      inkscape:connector-curvature="0"
@@ -1319,11 +415,232 @@
    inkscape:connector-curvature="0"
    id="path10839"
    d="m 340.92999,182.22096 0.55617,50.61113"
-   style="fill:#000000;fill-opacity:0.188235;stroke:#8c8c8c;stroke-width:0.88;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:2.4;stroke-dasharray:2.64, 0.88;stroke-dashoffset:0;stroke-opacity:1" /></g><g
+   style="fill:#000000;fill-opacity:0.188235;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:2.4;stroke-dasharray:1.43716538,0.47905511;stroke-dashoffset:0;stroke-opacity:1" /><text
+   x="68.474495"
+   y="154.48703"
+   class="st2"
+   v:langID="1031"
+   id="text4318"
+   style="font-size:9.59927px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />RP ID HASH</text><text
+   x="145.4762"
+   y="154.48222"
+   class="st2"
+   v:langID="1031"
+   id="text4332"
+   style="font-size:9.59927px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />FLAGS</text><text
+   x="215.93996"
+   y="154.48701"
+   class="st2"
+   v:langID="1031"
+   id="text4418"
+   style="font-size:9.59927px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />COUNTER</text><text
+   x="327.23721"
+   y="154.46301"
+   class="st2"
+   v:langID="1031"
+   id="text4432"
+   style="font-size:9.59927px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />ATTESTED CRED. DATA</text><text
+   x="453.92862"
+   y="154.48703"
+   class="st2"
+   v:langID="1031"
+   id="text4446"
+   style="font-size:9.59927px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />EXTENSIONS</text><text
+   x="68.551285"
+   y="132.89052"
+   class="st7"
+   v:langID="1031"
+   id="text4474"
+   style="font-size:7.67938px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />32 bytes</text><text
+   x="145.57028"
+   y="132.89052"
+   class="st7"
+   v:langID="1031"
+   id="text4483"
+   style="font-size:7.67938px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />1 byte</text><text
+   x="216.23369"
+   y="132.89052"
+   class="st7"
+   v:langID="1031"
+   id="text4492"
+   style="font-size:7.67938px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0417463,0.95992662)">4 bytes (big-endian uint32)<v:paragraph /><v:tabList /></text><text
+   x="336.55118"
+   y="129.21092"
+   class="st7"
+   v:langID="1031"
+   id="text4501"
+   style="font-size:7.46675px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.933347;stroke-linecap:square;stroke-miterlimit:3"
+   transform="scale(1.0129014,0.98726293)"><v:paragraph /><v:tabList />variable length </text><g
+   id="g5437"><rect
+     x="81.59819"
+     y="179.80031"
+     width="136.063"
+     height="21.403744"
+     class="st3"
+     id="rect4234"
+     style="fill:none;stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 98.60607,179.80122 V 184.086"
+     class="st4"
+     id="path4239"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 98.60607,196.92378 v 4.28478"
+     class="st4"
+     id="path4244"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 115.61394,179.80122 V 184.086"
+     class="st4"
+     id="path4249"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 115.61394,196.92378 v 4.28478"
+     class="st4"
+     id="path4254"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 132.62182,179.80122 V 184.086"
+     class="st4"
+     id="path4259"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 132.62182,196.92378 v 4.28478"
+     class="st4"
+     id="path4264"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 149.62969,179.80122 V 184.086"
+     class="st4"
+     id="path4269"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 149.62969,196.92378 v 4.28478"
+     class="st4"
+     id="path4274"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 166.63757,179.80122 V 184.086"
+     class="st4"
+     id="path4279"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 166.63757,196.92378 v 4.28478"
+     class="st4"
+     id="path4284"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 183.64544,179.80122 V 184.086"
+     class="st4"
+     id="path4289"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 183.64544,196.92378 v 4.28478"
+     class="st4"
+     id="path4294"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="M 200.65332,179.80122 V 184.086"
+     class="st4"
+     id="path4299"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><path
+     d="m 200.65332,196.92378 v 4.28478"
+     class="st4"
+     id="path4304"
+     inkscape:connector-curvature="0"
+     style="stroke:#000000;stroke-width:0.479963;stroke-linecap:round;stroke-linejoin:round" /><text
+     transform="scale(1.0417463,0.95992662)"
+     style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:8.8px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:center;writing-mode:lr-tb;text-anchor:middle;fill:#000000"
+     id="text4368"
+     v:langID="1031"
+     class="st6"
+     y="201.60094"
+     x="167.72699"><v:paragraph /><v:tabList /><tspan
+       style="font-size:8.8px;line-height:1.25;text-align:center;text-anchor:middle"
+       y="201.60094"
+       x="167.72699"
+       id="tspan4132"
+       sodipodi:role="line">UV</tspan></text><text
+     transform="scale(1.0417463,0.95992662)"
+     style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:8.8px;line-height:0%;font-family:Calibri;-inkscape-font-specification:'Calibri, Normal';text-align:center;writing-mode:lr-tb;text-anchor:middle;fill:#000000"
+     id="text4404"
+     v:langID="1031"
+     class="st7"
+     y="201.60094"
+     x="200.60402"><v:paragraph /><v:tabList /><tspan
+       style="font-size:8.8px;line-height:1.25;text-align:center;text-anchor:middle"
+       sodipodi:role="line"
+       id="tspan4126"
+       x="200.60402"
+       y="201.60094">UP</tspan></text><text
+     style="font-size:6.71943px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     id="text4015-9"
+     v:langID="1031"
+     class="st10"
+     y="219.83833"
+     x="200.77562"
+     transform="scale(1.0417463,0.95992662)">0<v:paragraph /><v:tabList /></text><text
+     x="86.508232"
+     y="219.83833"
+     class="st10"
+     v:langID="1031"
+     id="text4538"
+     style="font-size:6.71943px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000;stroke-width:0.959927"
+     transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />7</text><text
+     x="86.333031"
+     y="201.60094"
+     class="st6"
+     v:langID="1031"
+     id="text4395"
+     style="font-size:8.8px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />ED</text><text
+     x="102.86614"
+     y="201.60094"
+     class="st6"
+     v:langID="1031"
+     id="text4386"
+     style="font-size:8.8px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />AT</text><text
+     x="119.14406"
+     y="201.60094"
+     class="st6"
+     v:langID="1031"
+     id="text4341"
+     style="font-size:8.8px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />0</text><text
+     x="135.25037"
+     y="201.60094"
+     class="st6"
+     v:langID="1031"
+     id="text4350"
+     style="font-size:8.8px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     transform="scale(1.0417463,0.95992662)">BS<v:paragraph /><v:tabList /></text><text
+     x="151.63388"
+     y="201.60094"
+     class="st6"
+     v:langID="1031"
+     id="text4359"
+     style="font-size:8.8px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     transform="scale(1.0417463,0.95992662)">BE<v:paragraph /><v:tabList /></text><text
+     x="184.44931"
+     y="201.60094"
+     class="st6"
+     v:langID="1031"
+     id="text4377"
+     style="font-size:8.8px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;overflow:visible;color-interpolation-filters:sRGB;fill:#000000;fill-rule:evenodd;stroke-width:0.959927;stroke-linecap:square;stroke-miterlimit:3"
+     transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />0</text></g></g><g
    id="g10889"
    transform="matrix(-0.73051354,0,0,1,513.81788,2.5139507)"
    style="stroke-width:1.16681"><path
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.936px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.56049448;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none"
      d="m 554.30565,322.10675 c 12.75093,26.31597 49.0423,4.95336 49.0423,25.68716"
      id="path10871"
      inkscape:connector-curvature="0"
@@ -1332,59 +649,147 @@
      inkscape:connector-curvature="0"
      id="path10873"
      d="m 554.07676,322.68543 c -64.8064,46.09955 -368.04963,-13.76687 -366.40593,22.9448"
-     style="fill:none;stroke:#8c8c8c;stroke-width:0.936px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /></g><g
-   id="g5022"
-   transform="matrix(1,0,0,1.3285155,1.3335547,-10.161058)"><g
-     transform="translate(-0.260703)"
-     id="g5017"><path
-       sodipodi:nodetypes="cc"
-       inkscape:connector-curvature="0"
-       id="path4748"
-       d="M 51.078383,84.264422 C 70.907411,53.279458 114.11909,74.618817 114.73667,58.364778"
-       style="fill:none;stroke:#8c8c8c;stroke-width:0.97517px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1" /><path
-       style="fill:none;stroke:#8c8c8c;stroke-width:0.767457px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       d="M 51.078383,84.264422 C 92.937569,47.635631 377.99205,103.69762 374.66208,58.364778"
-       id="path4750"
-       inkscape:connector-curvature="0"
-       sodipodi:nodetypes="cc" /></g></g><path
-   style="fill:none;stroke:#8c8c8c;stroke-width:0.777084;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:3;stroke-dasharray:2.33125, 0.777084;stroke-dashoffset:0;stroke-opacity:1"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.56049448;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none" /></g><g
+   transform="matrix(1,0,0,1.3285155,1.0728517,-10.161058)"
+   id="g5017"><path
+     sodipodi:nodetypes="cc"
+     inkscape:connector-curvature="0"
+     id="path4748"
+     d="M 51.078383,84.264422 C 70.907411,53.279458 114.11909,74.618817 114.73667,58.364778"
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.41562548;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none" /><path
+     style="fill:none;stroke:#8c8c8c;stroke-width:0.41562548;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;stroke-dasharray:none"
+     d="M 51.078383,84.264422 C 92.937569,47.635631 377.99205,103.69762 374.66208,58.364778"
+     id="path4750"
+     inkscape:connector-curvature="0"
+     sodipodi:nodetypes="cc" /></g><path
+   style="fill:none;stroke:#8c8c8c;stroke-width:0.47905511;stroke-linecap:butt;stroke-linejoin:miter;stroke-miterlimit:3;stroke-dasharray:1.43716407,0.47905511;stroke-dashoffset:0;stroke-opacity:1"
    d="m 52.151235,101.78552 c -0.05806,32.94497 -0.03315,90.58951 -0.03315,113.01094 0,62.64971 56.941755,46.65433 56.941755,96.93881 0,9.48236 -0.003,4.58522 -0.003,13.4641"
    id="path10901"
    inkscape:connector-curvature="0"
-   sodipodi:nodetypes="cssc" /><g
-   id="g12180"
-   transform="translate(-155.58141,0.33995431)"><g
-   id="g1560"
-   transform="translate(-4.0781189)"><text
-     x="222.69807"
-     y="377.0697"
-     class="st2"
-     v:langID="1031"
-     id="text4603"
-     style="font-size:9.59927px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:0.960003;stroke-miterlimit:3;stroke-dasharray:none"
-     transform="scale(1.0417463,0.95992663)"><v:paragraph /><v:tabList />ATTESTATION STATEMENT</text><text
-     transform="scale(1.0417463,0.95992663)"
-     x="352.17941"
-     y="376.21729"
-     class="st2"
-     v:langID="1031"
-     id="text10915"
-     style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000"><tspan
-       style="font-size:8px"
-       id="tspan4706">(in &quot;packed&quot; attestation statement format)</tspan><v:paragraph /><v:tabList /></text></g>
+   sodipodi:nodetypes="cssc" />
+<g
+   id="g664"><g
+     id="g1553"
+     transform="translate(-33.118635,9.0126739)"><g
+       id="shape60-158"
+       v:mID="60"
+       v:groupContext="shape"
+       transform="matrix(1,0,0,0.92145913,207.07412,-166.51228)"><title
+   id="title4606">Rechteck.3</title><desc
+   id="desc4608">“sig“: ...</desc><v:userDefs><v:ud
+     v:nameU="visVersion"
+     v:val="VT0(15):26" /></v:userDefs><v:textBlock
+   v:margins="rect(4,4,4,4)"
+   v:tabSpace="42.5197" /><v:textRect
+   cx="50.7087"
+   cy="583.937"
+   width="101.42"
+   height="22.6772" /><rect
+   x="0"
+   y="572.59802"
+   width="101.417"
+   height="22.6772"
+   class="st11"
+   id="rect4610"
+   style="fill:none;stroke:#000000;stroke-width:0.49905388;stroke-dasharray:none" /><text
+   x="51.008499"
+   y="586.42163"
+   class="st2"
+   v:langID="1031"
+   id="text4612"
+   style="font-size:10px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"><v:paragraph /><v:tabList />“sig“:   ...</text>
 
-</g>
-<flowRoot
-   transform="matrix(0.8,0,0,0.8,46.055674,-0.68873319)"
-   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;line-height:0.01%;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';text-align:start;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;image-rendering:auto"
-   id="flowRoot10992"
-   xml:space="preserve"><flowRegion
-     id="flowRegion10994"><rect
-       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:40px;line-height:125%;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start"
-       y="500.99292"
-       x="31.979567"
-       height="15.294538"
-       width="494.98804"
-       id="rect10996" /></flowRegion><flowPara
-     style="font-size:11.25px;line-height:1.25;opacity:1"
-     id="flowPara11000">[Other attestation statement formats are as defined in their respective sections below]</flowPara></flowRoot></svg>
+</g><g
+       id="shape61-161"
+       v:mID="61"
+       v:groupContext="shape"
+       transform="matrix(1,0,0,0.92145913,105.65712,-166.51228)"><title
+   id="title4615">Rechteck.5</title><desc
+   id="desc4617">“alg“: ...</desc><v:userDefs><v:ud
+     v:nameU="visVersion"
+     v:val="VT0(15):26" /></v:userDefs><v:textBlock
+   v:margins="rect(4,4,4,4)"
+   v:tabSpace="42.5197" /><v:textRect
+   cx="50.7087"
+   cy="583.937"
+   width="101.42"
+   height="22.6772" /><rect
+   x="0"
+   y="572.59802"
+   width="101.417"
+   height="22.6772"
+   class="st11"
+   id="rect4619"
+   style="fill:none;stroke:#000000;stroke-width:0.49905388;stroke-dasharray:none" /><text
+   x="51.008499"
+   y="586.53662"
+   class="st2"
+   v:langID="1031"
+   id="text4623"
+   style="font-size:10px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"><v:paragraph /><v:tabList />“alg<tspan
+   class="st12"
+   v:langID="1033"
+   id="tspan4621"
+   style="font-size:10px;text-align:center;text-anchor:middle">“</tspan>:   ...</text>
+
+</g><g
+       transform="matrix(1,0,0,0.92145913,308.49212,-166.51228)"
+       v:groupContext="shape"
+       v:mID="62"
+       id="shape62-165"><title
+   id="title4626">Rechteck.6</title><desc
+   id="desc4628">“x5c“: ...</desc><v:userDefs><v:ud
+     v:val="VT0(15):26"
+     v:nameU="visVersion" /></v:userDefs><v:textBlock
+   v:tabSpace="42.5197"
+   v:margins="rect(4,4,4,4)" /><v:textRect
+   height="22.6772"
+   width="101.42"
+   cy="583.937"
+   cx="50.7087" /><rect
+   style="fill:none;stroke:#000000;stroke-width:0.49905388;stroke-dasharray:none"
+   id="rect4630"
+   class="st11"
+   height="22.6772"
+   width="101.417"
+   y="572.59802"
+   x="0" /><text
+   style="font-size:10px;line-height:0%;font-family:Calibri;text-align:center;text-anchor:middle;fill:#000000"
+   id="text4632"
+   v:langID="1031"
+   class="st2"
+   y="587.43665"
+   x="51.008499"><v:paragraph /><v:tabList />“x5c“:   ...</text>
+
+</g></g><g
+     id="g1560"
+     transform="translate(-159.58141,0.33995431)"><text
+       x="222.69807"
+       y="377.0697"
+       class="st2"
+       v:langID="1031"
+       id="text4603"
+       style="font-size:9.59927px;line-height:0%;font-family:Calibri;fill:#000000;stroke-width:0.960003;stroke-miterlimit:3;stroke-dasharray:none"
+       transform="scale(1.0417463,0.95992662)"><v:paragraph /><v:tabList />ATTESTATION STATEMENT</text><text
+       transform="scale(1.0417463,0.95992662)"
+       x="352.17941"
+       y="377.0697"
+       class="st2"
+       v:langID="1031"
+       id="text10915"
+       style="font-size:9.5993px;line-height:0%;font-family:Calibri;fill:#000000"><tspan
+         style="font-size:8px"
+         id="tspan4706">(in &quot;packed&quot; attestation statement format)</tspan><v:paragraph /><v:tabList /></text></g><flowRoot
+     transform="matrix(0.8,0,0,0.8,46.133793,-0.68873319)"
+     style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;line-height:0.01%;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';text-align:start;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1;image-rendering:auto"
+     id="flowRoot10992"
+     xml:space="preserve"><flowRegion
+       id="flowRegion10994"><rect
+         style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:40px;line-height:125%;font-family:sans-serif;-inkscape-font-specification:'sans-serif, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start"
+         y="500.99292"
+         x="31.979567"
+         height="15.294538"
+         width="494.98804"
+         id="rect10996" /></flowRegion><flowPara
+       style="font-size:11.25px;line-height:1.25;opacity:1"
+       id="flowPara11000">[Other attestation statement formats are as defined in their respective sections below]</flowPara></flowRoot></g></svg>
diff --git a/images/fido-signature-formats-figure1.svg b/images/fido-signature-formats-figure1.svg
index 673af3175..1b15f56be 100644
--- a/images/fido-signature-formats-figure1.svg
+++ b/images/fido-signature-formats-figure1.svg
@@ -2,13 +2,6 @@
 <!-- Generator: Adobe Illustrator 21.0.2, SVG Export Plug-In . SVG Version: 6.00 Build 0)  -->
 
 <svg
-   xmlns:dc="http://purl.org/dc/elements/1.1/"
-   xmlns:cc="http://creativecommons.org/ns#"
-   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
-   xmlns:svg="http://www.w3.org/2000/svg"
-   xmlns="http://www.w3.org/2000/svg"
-   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
-   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
    version="1.1"
    id="Layer_1"
    x="0px"
@@ -16,8 +9,15 @@
    viewBox="0 0 525.2 113.4"
    style="enable-background:new 0 0 525.2 113.4;"
    xml:space="preserve"
-   inkscape:version="0.91 r13725"
-   sodipodi:docname="fido-signature-formats-figure1.svg"><metadata
+   inkscape:version="1.2 (dc2aedaf03, 2022-05-15)"
+   sodipodi:docname="fido-signature-formats-figure1.svg"
+   xmlns:inkscape="http://www.inkscape.org/namespaces/inkscape"
+   xmlns:sodipodi="http://sodipodi.sourceforge.net/DTD/sodipodi-0.dtd"
+   xmlns="http://www.w3.org/2000/svg"
+   xmlns:svg="http://www.w3.org/2000/svg"
+   xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"
+   xmlns:cc="http://creativecommons.org/ns#"
+   xmlns:dc="http://purl.org/dc/elements/1.1/"><metadata
      id="metadata4796"><rdf:RDF><cc:Work
          rdf:about=""><dc:format>image/svg+xml</dc:format><dc:type
            rdf:resource="http://purl.org/dc/dcmitype/StillImage" /></cc:Work></rdf:RDF></metadata><sodipodi:namedview
@@ -29,17 +29,20 @@
      guidetolerance="10"
      inkscape:pageopacity="0"
      inkscape:pageshadow="2"
-     inkscape:window-width="1569"
-     inkscape:window-height="1038"
+     inkscape:window-width="1584"
+     inkscape:window-height="843"
      id="namedview4794"
      showgrid="false"
-     inkscape:zoom="1.6694828"
-     inkscape:cx="160.08064"
-     inkscape:cy="148.93093"
+     inkscape:zoom="6.625266"
+     inkscape:cx="144.97531"
+     inkscape:cy="19.923728"
      inkscape:window-x="0"
      inkscape:window-y="0"
-     inkscape:window-maximized="0"
-     inkscape:current-layer="g4658" /><style
+     inkscape:window-maximized="1"
+     inkscape:current-layer="g4658"
+     inkscape:showpageshadow="2"
+     inkscape:pagecheckerboard="0"
+     inkscape:deskcolor="#d1d1d1" /><style
      type="text/css"
      id="style4644">
 	.st0{fill:none;stroke:#000000;stroke-width:0.5;stroke-linecap:round;stroke-linejoin:round;}
@@ -110,344 +113,367 @@
            name="HelveticaNeue" /></font-face-src></font-face></defs><title
      id="title4656">authenticatorData</title><g
      id="g4658"><title
-       id="title4660">Layer 1</title><rect
-       x="75.7"
-       y="16.5"
-       class="st0"
-       width="136.1"
-       height="23.2"
-       id="rect4662" /><line
-       class="st0"
-       x1="92.7"
-       y1="16.5"
-       x2="92.7"
-       y2="21.1"
-       id="line4664" /><line
-       class="st0"
-       x1="92.7"
-       y1="35"
-       x2="92.7"
-       y2="39.7"
-       id="line4666" /><line
-       class="st0"
-       x1="109.7"
-       y1="16.5"
-       x2="109.7"
-       y2="21.1"
-       id="line4668" /><line
-       class="st0"
-       x1="109.7"
-       y1="35"
-       x2="109.7"
-       y2="39.7"
-       id="line4670" /><line
-       class="st0"
-       x1="126.7"
-       y1="16.5"
-       x2="126.7"
-       y2="21.1"
-       id="line4672" /><line
-       class="st0"
-       x1="126.7"
-       y1="35"
-       x2="126.7"
-       y2="39.7"
-       id="line4674" /><line
-       class="st0"
-       x1="143.7"
-       y1="16.5"
-       x2="143.7"
-       y2="21.1"
-       id="line4676" /><line
-       class="st0"
-       x1="143.7"
-       y1="35"
-       x2="143.7"
-       y2="39.7"
-       id="line4678" /><line
-       class="st0"
-       x1="160.7"
-       y1="16.5"
-       x2="160.7"
-       y2="21.1"
-       id="line4680" /><line
-       class="st0"
-       x1="160.7"
-       y1="35"
-       x2="160.7"
-       y2="39.7"
-       id="line4682" /><line
-       class="st0"
-       x1="177.7"
-       y1="16.5"
-       x2="177.7"
-       y2="21.1"
-       id="line4684" /><line
-       class="st0"
-       x1="177.7"
-       y1="35"
-       x2="177.7"
-       y2="39.7"
-       id="line4686" /><line
-       class="st0"
-       x1="194.7"
-       y1="16.5"
-       x2="194.7"
-       y2="21.1"
-       id="line4688" /><line
-       class="st0"
-       x1="194.7"
-       y1="35"
-       x2="194.7"
-       y2="39.7"
-       id="line4690" /><rect
-       x="5.6"
-       y="70.9"
-       class="st0"
-       width="115.4"
-       height="22.7"
-       id="rect4692" /><text
-       transform="matrix(1 0 0 1 31.7758 86.2047)"
-       class="st1 st2"
-       id="text4694">RP ID hash</text>
+   id="title4660">Layer 1</title><rect
+   x="75.699997"
+   y="16.5"
+   class="st0"
+   width="136.10001"
+   height="23.200001"
+   id="rect4662"
+   style="fill:none;stroke:#000000;stroke-width:0.63874016;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none" /><line
+   class="st0"
+   x1="92.712494"
+   y1="16.5"
+   x2="92.712494"
+   y2="21.1"
+   id="line4664"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="92.712494"
+   y1="35"
+   x2="92.712494"
+   y2="39.700001"
+   id="line4666"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="109.725"
+   y1="16.5"
+   x2="109.725"
+   y2="21.1"
+   id="line4668"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="109.725"
+   y1="35"
+   x2="109.725"
+   y2="39.700001"
+   id="line4670"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="126.7375"
+   y1="16.5"
+   x2="126.7375"
+   y2="21.1"
+   id="line4672"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="126.7375"
+   y1="35"
+   x2="126.7375"
+   y2="39.700001"
+   id="line4674"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="143.75"
+   y1="16.5"
+   x2="143.75"
+   y2="21.1"
+   id="line4676"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="143.75"
+   y1="35"
+   x2="143.75"
+   y2="39.700001"
+   id="line4678"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="160.7625"
+   y1="16.5"
+   x2="160.7625"
+   y2="21.1"
+   id="line4680"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="160.7625"
+   y1="35"
+   x2="160.7625"
+   y2="39.700001"
+   id="line4682"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="177.77499"
+   y1="16.5"
+   x2="177.77499"
+   y2="21.1"
+   id="line4684"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="177.77499"
+   y1="35"
+   x2="177.77499"
+   y2="39.700001"
+   id="line4686"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="194.78751"
+   y1="16.5"
+   x2="194.78751"
+   y2="21.1"
+   id="line4688"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><line
+   class="st0"
+   x1="194.78751"
+   y1="35"
+   x2="194.78751"
+   y2="39.700001"
+   id="line4690"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><rect
+   x="5.6"
+   y="70.9"
+   class="st0"
+   width="115.4"
+   height="22.7"
+   id="rect4692"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><text
+   class="st1 st2"
+   id="text4694"
+   x="63.220001"
+   y="86"
+   style="text-align:center;text-anchor:middle">RP ID HASH</text>
 <rect
-       x="121"
-       y="70.9"
-       class="st0"
-       width="45.4"
-       height="22.7"
-       id="rect4696" /><text
-       transform="matrix(1 0 0 1 127.7758 86.2047)"
-       class="st1 st2"
-       id="text4698">FLAGS</text>
+   x="121"
+   y="70.9"
+   class="st0"
+   width="45.4"
+   height="22.7"
+   id="rect4696"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><text
+   class="st1 st2"
+   id="text4698"
+   x="143.45"
+   y="85.82"
+   style="text-align:center;text-anchor:middle">FLAGS</text>
 <text
-       transform="matrix(1 0 0 1 115.683 31.2833)"
-       class="st1 st3"
-       id="text4700">0</text>
+   class="st1 st3"
+   id="text4700"
+   x="118.23125"
+   y="31.268"
+   style="text-align:center;text-anchor:middle">0</text>
 <text
-       transform="matrix(1 0 0 1 132.6909 31.2833)"
-       class="st1 st3"
-       id="text4702">0</text>
+   class="st1 st3"
+   id="text4702"
+   x="135.01875"
+   y="31.268"
+   style="text-align:center;text-anchor:middle">BS</text>
 <text
-       transform="matrix(1 0 0 1 149.6988 31.2833)"
-       class="st1 st3"
-       id="text4704">0</text>
-<rect
-       x="95.2"
-       y="23.6"
-       class="st4"
-       width="11.8"
-       height="10.6"
-       id="rect4706" /><text
-       transform="matrix(1 0 0 1 95.2446 31.2832)"
-       class="st1 st3"
-       id="text4708">A</text>
+   class="st1 st3"
+   id="text4704"
+   x="152.08975"
+   y="31.268"
+   style="text-align:center;text-anchor:middle">BE</text>
 <text
-       transform="matrix(1 0 0 1 101.5446 31.2832)"
-       class="st1 st3"
-       id="text4710">T</text>
+   class="st1 st3"
+   id="text4708"
+   x="101.26824"
+   y="31.268"
+   style="text-align:center;text-anchor:middle">AT</text>
+
 <text
-       transform="matrix(1 0 0 1 78.2518 31.479)"
-       class="st1 st3"
-       id="text4712">ED</text>
+   class="st1 st3"
+   id="text4712"
+   x="84.044243"
+   y="31.268"
+   style="text-align:center;text-anchor:middle">ED</text>
 <text
-       class="st1 st5"
-       id="text4714"
-       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:8px;line-height:125%;font-family:ArialMT;-inkscape-font-specification:'ArialMT, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start"
-       sodipodi:linespacing="125%"
-       x="198.45123"
-       y="30.431011"><tspan
-         sodipodi:role="line"
-         id="tspan4864"
-         x="198.45123"
-         y="30.431011">UP</tspan></text>
+   class="st1 st5"
+   id="text4714"
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:9px;line-height:0;font-family:ArialMT;-inkscape-font-specification:'ArialMT, Normal';text-align:center;writing-mode:lr-tb;text-anchor:middle"
+   x="203.11826"
+   y="31.268"><tspan
+     sodipodi:role="line"
+     id="tspan4864"
+     x="203.11826"
+     y="31.268">UP</tspan></text>
 <rect
-       x="166.4"
-       y="70.9"
-       class="st0"
-       width="101.4"
-       height="22.7"
-       id="rect4716" /><text
-       transform="matrix(1 0 0 1 193.1066 86.2047)"
-       class="st1 st2"
-       id="text4718">COUNTER</text>
+   x="166.4"
+   y="70.9"
+   class="st0"
+   width="101.4"
+   height="22.7"
+   id="rect4716"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><text
+   class="st1 st2"
+   id="text4718"
+   x="216.87"
+   y="85.825005"
+   style="text-align:center;text-anchor:middle">COUNTER</text>
 <rect
-       x="267.8"
-       y="70.9"
-       class="st0"
-       width="130"
-       height="22.7"
-       id="rect4720" /><rect
-       x="282.1"
-       y="77.6"
-       class="st4"
-       width="98"
-       height="11.8"
-       id="rect4722" /><text
-       class="st1 st2"
-       id="text4724"
-       x="275.87903"
-       y="86.204102">ATTESTED CRED. DATA</text>
+   x="267.8"
+   y="70.9"
+   class="st0"
+   width="130"
+   height="22.7"
+   id="rect4720"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><rect
+   x="282.10001"
+   y="76.349998"
+   class="st4"
+   width="98"
+   height="11.8"
+   id="rect4722" /><text
+   class="st1 st2"
+   id="text4724"
+   x="332.80499"
+   y="85.800003"
+   style="text-align:center;text-anchor:middle">ATTESTED CRED. DATA</text>
 <text
-       transform="translate(350.9908,86.2041)"
-       class="st1 st2"
-       id="text4726"
-       style="font-size:10px;font-family:ArialMT" />
+   transform="translate(350.9908,86.2041)"
+   class="st1 st2"
+   id="text4726"
+   style="font-size:10px;font-family:ArialMT" />
 <rect
-       x="397.8"
-       y="70.9"
-       class="st0"
-       width="118.9"
-       height="22.7"
-       id="rect4730" /><text
-       transform="matrix(1 0 0 1 426.4141 86.2047)"
-       class="st1 st2"
-       id="text4732">EXTENSIONS</text>
-<path
-       class="st6"
-       d="M496.9,68l2.8,9.4l-2.8,9.4l2.8,9.4h5.7l-2.8-9.4l2.8-9.4l-2.8-9.4H496.9z"
-       id="path4734" /><path
-       class="st0"
-       d="M496.9,68l2.8,9.4l-2.8,9.4l2.8,9.4"
-       id="path4736" /><path
-       class="st0"
-       d="M502.5,68l2.8,9.4l-2.8,9.4l2.8,9.4"
-       id="path4738" /><text
-       transform="matrix(1 0 0 1 40.2462 106.5433)"
-       class="st1 st5"
-       id="text4740">32 bytes</text>
-<rect
-       x="132.2"
-       y="99.7"
-       class="st4"
-       width="22.2"
-       height="9.5"
-       id="rect4742" /><text
-       transform="matrix(1 0 0 1 132.2461 106.5435)"
-       class="st1 st5"
-       id="text4744">1</text>
+   x="397.8"
+   y="70.9"
+   class="st0"
+   width="118.9"
+   height="22.7"
+   id="rect4730"
+   style="stroke-width:0.63874016;stroke-dasharray:none" /><text
+   class="st1 st2"
+   id="text4732"
+   x="457"
+   y="85.825005"
+   style="text-align:center;text-anchor:middle">EXTENSIONS</text>
 <text
-       transform="matrix(1 0 0 1 136.6461 106.5435)"
-       class="st1 st5"
-       id="text4746" />
-<text
-       transform="matrix(1 0 0 1 139.3461 106.5435)"
-       class="st1 st5"
-       id="text4748">byte</text>
+   class="st1 st5"
+   id="text4740"
+   x="63.299999"
+   y="106.5433"
+   style="text-align:center;text-anchor:middle">32 bytes</text><g
+   id="g3555"
+   transform="translate(2)"><path
+     class="st6"
+     d="m 496.9,68 2.8,9.4 -2.8,9.4 2.8,9.4 h 5.7 l -2.8,-9.4 2.8,-9.4 -2.8,-9.4 z"
+     id="path4734" /><path
+     class="st0"
+     d="m 496.9,68 2.8,9.4 -2.8,9.4 2.8,9.4"
+     id="path4736"
+     style="stroke-width:0.63874;stroke-dasharray:none" /><path
+     class="st0"
+     d="m 502.5,68 2.8,9.4 -2.8,9.4 2.8,9.4"
+     id="path4738"
+     style="stroke-width:0.63874;stroke-dasharray:none" /></g>
 <rect
-       x="169.8"
-       y="99.7"
-       class="st4"
-       width="95.1"
-       height="9.5"
-       id="rect4750" /><text
-       transform="matrix(1 0 0 1 169.8452 106.5435)"
-       class="st1 st5"
-       id="text4752">4</text>
+   x="132.2"
+   y="99.7"
+   class="st4"
+   width="22.2"
+   height="9.5"
+   id="rect4742" />
 <text
-       transform="matrix(1 0 0 1 174.2452 106.5435)"
-       class="st1 st5"
-       id="text4754" />
+   transform="matrix(1 0 0 1 136.6461 106.5435)"
+   class="st1 st5"
+   id="text4746" />
 <text
-       transform="matrix(1 0 0 1 176.6452 106.5435)"
-       class="st1 st5"
-       id="text4756">bytes</text>
+   class="st1 st5"
+   id="text4748"
+   x="143.548"
+   y="106.5433"
+   style="text-align:center;text-anchor:middle">1 byte</text>
+<rect
+   x="169.8"
+   y="99.7"
+   class="st4"
+   width="95.1"
+   height="9.5"
+   id="rect4750" />
 <text
-       transform="matrix(1 0 0 1 195.7452 106.5435)"
-       class="st1 st5"
-       id="text4758" />
+   transform="matrix(1 0 0 1 174.2452 106.5435)"
+   class="st1 st5"
+   id="text4754" />
+
 <text
-       transform="matrix(1 0 0 1 198.1452 106.5435)"
-       class="st1 st5"
-       id="text4760">(big-endian</text>
+   transform="matrix(1 0 0 1 195.7452 106.5435)"
+   class="st1 st5"
+   id="text4758" />
 <text
-       transform="matrix(1 0 0 1 238.1452 106.5435)"
-       class="st1 st5"
-       id="text4762" />
+   class="st1 st5"
+   id="text4760"
+   x="217.17599"
+   y="106.5433"
+   style="text-align:center;text-anchor:middle">4 bytes (big-endian uint32)</text>
 <text
-       transform="matrix(1 0 0 1 240.5452 106.5435)"
-       class="st1 st5"
-       id="text4764">uint32)</text>
+   transform="matrix(1 0 0 1 238.1452 106.5435)"
+   class="st1 st5"
+   id="text4762" />
+
 <rect
-       x="284"
-       y="99.7"
-       class="st4"
-       width="94.3"
-       height="9.5"
-       id="rect4766" /><text
-       transform="matrix(1 0 0 1 283.9854 106.5435)"
-       class="st1 st5"
-       id="text4768">variable</text>
-<text
-       transform="matrix(1 0 0 1 311.9854 106.5435)"
-       class="st1 st5"
-       id="text4770" />
+   x="284"
+   y="99.7"
+   class="st4"
+   width="94.3"
+   height="9.5"
+   id="rect4766" /><text
+   class="st1 st5"
+   id="text4768"
+   x="332.888"
+   y="106.5433"
+   style="text-align:center;text-anchor:middle">variable length if present</text>
 <text
-       transform="matrix(1 0 0 1 314.8854 106.5435)"
-       class="st1 st5"
-       id="text4772">length</text>
-<text
-       transform="matrix(1 0 0 1 336.5854 106.5435)"
-       class="st1 st5"
-       id="text4774" />
+   transform="matrix(1 0 0 1 311.9854 106.5435)"
+   class="st1 st5"
+   id="text4770" />
+
 <text
-       transform="matrix(1 0 0 1 339.4854 106.5435)"
-       class="st1 st5"
-       id="text4776">(if</text>
+   transform="matrix(1 0 0 1 336.5854 106.5435)"
+   class="st1 st5"
+   id="text4774" />
+
 <text
-       transform="matrix(1 0 0 1 346.1854 106.5435)"
-       class="st1 st5"
-       id="text4778" />
+   transform="matrix(1 0 0 1 346.1854 106.5435)"
+   class="st1 st5"
+   id="text4778" />
+
 <text
-       transform="matrix(1 0 0 1 348.9854 106.5435)"
-       class="st1 st5"
-       id="text4780">present)</text>
+   class="st1 st5"
+   id="text4782"
+   x="457.40997"
+   y="106.5433"
+   style="text-align:center;text-anchor:middle">variable length if present (CBOR)</text>
 <text
-       transform="matrix(1 0 0 1 418.9855 106.5433)"
-       class="st1 st5"
-       id="text4782">variable length (CBOR)</text>
-<line
-       class="st0"
-       x1="78.5"
-       y1="42.5"
-       x2="118.2"
-       y2="68"
-       id="line4784" /><line
-       class="st0"
-       x1="208.9"
-       y1="42.5"
-       x2="169.2"
-       y2="68"
-       id="line4786" /><text
-       transform="matrix(1 0 0 1 75 12.5)"
-       class="st1 st7"
-       id="text4788">7</text>
+   class="st1 st7"
+   id="text4788"
+   x="84.223747"
+   y="11.968012"
+   style="text-align:center;text-anchor:middle">7</text>
 <text
-       class="st1 st3"
-       id="text4790"
-       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:9px;line-height:125%;font-family:ArialMT;-inkscape-font-specification:'ArialMT, Normal';text-align:start;writing-mode:lr-tb;text-anchor:start"
-       sodipodi:linespacing="125%"
-       inkscape:transform-center-x="-2.9949394"
-       inkscape:transform-center-y="1.1979758"
-       x="163.10487"
-       y="30.684313"><tspan
-         sodipodi:role="line"
-         id="tspan4910"
-         x="163.10487"
-         y="30.684313">UV</tspan></text>
+   class="st1 st3"
+   id="text4790"
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:9px;line-height:0;font-family:ArialMT;-inkscape-font-specification:'ArialMT, Normal';text-align:center;writing-mode:lr-tb;text-anchor:middle"
+   inkscape:transform-center-x="-2.9949394"
+   inkscape:transform-center-y="1.1979758"
+   x="168.86375"
+   y="31.268"><tspan
+     sodipodi:role="line"
+     id="tspan4910"
+     x="168.86375"
+     y="31.268"
+     style="line-height:0">UV</tspan></text>
 <text
-       transform="matrix(1 0 0 1 183.6988 31.2833)"
-       class="st1 st3"
-       id="text4792">0</text>
+   class="st1 st3"
+   id="text4792"
+   x="186.28125"
+   y="31.268"
+   style="text-align:center;text-anchor:middle">0</text>
 <text
-       xml:space="preserve"
-       style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7.5px;line-height:125%;font-family:ArialMT;-inkscape-font-specification:'ArialMT, Normal';text-align:start;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:start;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
-       x="209.64575"
-       y="13.968012"
-       id="text4906"
-       sodipodi:linespacing="125%"><tspan
-         sodipodi:role="line"
-         id="tspan4908"
-         x="209.64575"
-         y="13.968012">0</tspan></text>
-</g></svg>
\ No newline at end of file
+   xml:space="preserve"
+   style="font-style:normal;font-variant:normal;font-weight:normal;font-stretch:normal;font-size:7.5px;line-height:125%;font-family:ArialMT;-inkscape-font-specification:'ArialMT, Normal';text-align:center;letter-spacing:0px;word-spacing:0px;writing-mode:lr-tb;text-anchor:middle;fill:#000000;fill-opacity:1;stroke:none;stroke-width:1px;stroke-linecap:butt;stroke-linejoin:miter;stroke-opacity:1"
+   x="203.29376"
+   y="11.968012"
+   id="text4906"><tspan
+     sodipodi:role="line"
+     id="tspan4908"
+     x="203.29376"
+     y="11.968012">0</tspan></text>
+<path
+   id="path1129"
+   class="st0"
+   style="fill:none;stroke:#000000;stroke-width:0.63874016;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none"
+   d="M 79.787498,42.527188 116.902,68.027187"
+   sodipodi:nodetypes="cc" /><path
+   id="path1129-6"
+   class="st0"
+   style="fill:none;stroke:#000000;stroke-width:0.63874016;stroke-linecap:round;stroke-linejoin:round;stroke-dasharray:none"
+   d="m 207.60724,42.499998 -37.1145,25.499999"
+   sodipodi:nodetypes="cc" /></g></svg>
diff --git a/index.html b/index.html
index e65ccab1e..82e32ceb1 100644
--- a/index.html
+++ b/index.html
@@ -4,9 +4,9 @@
   <meta content="width=device-width, initial-scale=1, shrink-to-fit=no" name="viewport">
   <title>Web Authentication: An API for accessing Public Key Credentials - Level</title>
   <meta content="ED" name="w3c-status">
-  <meta content="Bikeshed version 37b7e7e68, updated Fri May 27 15:08:11 2022 -0700" name="generator">
+  <meta content="Bikeshed version 44af0bf3e, updated Fri Jul 29 17:05:16 2022 -0700" name="generator">
   <link href="https://www.w3.org/TR/webauthn-3/" rel="canonical">
-  <meta content="96223883ed9d1e3c1c53888e7e8810315091cda1" name="document-revision">
+  <meta content="6c823f1f8af0c7e63c4a309b141559fcb8990ff5" name="document-revision">
 <style type="text/css">
 body {
     counter-reset: table;
@@ -381,7 +381,7 @@
   <div class="head">
    <p data-fill-with="logo"><a class="logo" href="https://www.w3.org/"> <img alt="W3C" height="48" src="https://www.w3.org/StyleSheets/TR/2021/logos/W3C" width="72"> </a> </p>
    <h1>Web Authentication:<br>An API for accessing Public Key Credentials<br>Level 3</h1>
-   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2022-06-14">14 June 2022</time></p>
+   <p id="w3c-state"><a href="https://www.w3.org/standards/types#ED">Editor’s Draft</a>, <time class="dt-updated" datetime="2022-09-28">28 September 2022</time></p>
    <details open>
     <summary>More details about this document</summary>
     <div data-fill-with="spec-metadata">
@@ -522,10 +522,13 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
          <a href="#sctn-getAssertion"><span class="secno">5.1.4</span> <span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span></a>
          <ol class="toc">
           <li><a href="#sctn-discover-from-external-source"><span class="secno">5.1.4.1</span> <span class="content">PublicKeyCredential’s <code><span><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></span></code> Method</span></a>
+          <li><a href="#sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2</span> <span class="content"><span class="algorithm" data-algorithm="Issuing a credential request to an authenticator">Issuing a Credential Request to an Authenticator</span></span></a>
          </ol>
         <li><a href="#sctn-storeCredential"><span class="secno">5.1.5</span> <span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span></a>
         <li><a href="#sctn-preventSilentAccessCredential"><span class="secno">5.1.6</span> <span class="content">Preventing Silent Access to an Existing Credential - PublicKeyCredential’s <code>[[preventSilentAccess]](credential, sameOriginWithAncestors)</code> Method</span></a>
         <li><a href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.7</span> <span class="content">Availability of <span>User-Verifying Platform Authenticator</span> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span></a>
+        <li><a href="#sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8</span> <span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span></a>
+        <li><a href="#sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9</span> <span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span></a>
        </ol>
       <li>
        <a href="#iface-authenticatorresponse"><span class="secno">5.2</span> <span class="content">Authenticator Responses (interface <span><code>AuthenticatorResponse</code></span>)</span></a>
@@ -602,6 +605,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#sctn-op-make-cred"><span class="secno">6.3.2</span> <span class="content">The <span>authenticatorMakeCredential</span> Operation</span></a>
         <li><a href="#sctn-op-get-assertion"><span class="secno">6.3.3</span> <span class="content">The <span>authenticatorGetAssertion</span> Operation</span></a>
         <li><a href="#sctn-op-cancel"><span class="secno">6.3.4</span> <span class="content">The <span>authenticatorCancel</span> Operation</span></a>
+        <li><a href="#sctn-op-silent-discovery"><span class="secno">6.3.5</span> <span class="content">The <span>silentCredentialDiscovery</span> operation</span></a>
        </ol>
       <li>
        <a href="#sctn-strings"><span class="secno">6.4</span> <span class="content">String Handling</span></a>
@@ -665,11 +669,20 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
     <li>
      <a href="#sctn-defined-extensions"><span class="secno">10</span> <span class="content">Defined Extensions</span></a>
      <ol class="toc">
-      <li><a href="#sctn-appid-extension"><span class="secno">10.1</span> <span class="content">FIDO <span>AppID</span> Extension (appid)</span></a>
-      <li><a href="#sctn-appid-exclude-extension"><span class="secno">10.2</span> <span class="content">FIDO AppID Exclusion Extension (appidExclude)</span></a>
-      <li><a href="#sctn-uvm-extension"><span class="secno">10.3</span> <span class="content"><span>User Verification Method</span> Extension (uvm)</span></a>
-      <li><a href="#sctn-authenticator-credential-properties-extension"><span class="secno">10.4</span> <span class="content">Credential Properties Extension (<span>credProps</span>)</span></a>
-      <li><a href="#sctn-large-blob-extension"><span class="secno">10.5</span> <span class="content">Large blob storage extension (<span>largeBlob</span>)</span></a>
+      <li>
+       <a href="#sctn-defined-client-extensions"><span class="secno">10.1</span> <span class="content">Client Extensions</span></a>
+       <ol class="toc">
+        <li><a href="#sctn-appid-extension"><span class="secno">10.1.1</span> <span class="content">FIDO <span>AppID</span> Extension (appid)</span></a>
+        <li><a href="#sctn-appid-exclude-extension"><span class="secno">10.1.2</span> <span class="content">FIDO AppID Exclusion Extension (appidExclude)</span></a>
+        <li><a href="#sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3</span> <span class="content">Credential Properties Extension (<span>credProps</span>)</span></a>
+        <li><a href="#prf-extension"><span class="secno">10.1.4</span> <span class="content">Pseudo-random function extension (<span>prf</span>)</span></a>
+        <li><a href="#sctn-large-blob-extension"><span class="secno">10.1.5</span> <span class="content">Large blob storage extension (<span>largeBlob</span>)</span></a>
+       </ol>
+      <li>
+       <a href="#sctn-defined-authenticator-extensions"><span class="secno">10.2</span> <span class="content">Authenticator Extensions</span></a>
+       <ol class="toc">
+        <li><a href="#sctn-uvm-extension"><span class="secno">10.2.1</span> <span class="content"><span>User Verification Method</span> Extension (uvm)</span></a>
+       </ol>
      </ol>
     <li>
      <a href="#sctn-automation"><span class="secno">11</span> <span class="content">User Agent Automation</span></a>
@@ -717,6 +730,7 @@ <h2 class="no-num no-toc no-ref" id="contents">Table of Contents</h2>
         <li><a href="#sctn-revoked-attestation-certificates"><span class="secno">13.4.5</span> <span class="content">Revoked Attestation Certificates</span></a>
         <li><a href="#sctn-credential-loss-key-mobility"><span class="secno">13.4.6</span> <span class="content">Credential Loss and Key Mobility</span></a>
         <li><a href="#sctn-unprotected-account-detection"><span class="secno">13.4.7</span> <span class="content">Unprotected account detection</span></a>
+        <li><a href="#sctn-code-injection"><span class="secno">13.4.8</span> <span class="content">Code injection attacks</span></a>
        </ol>
      </ol>
     <li>
@@ -1355,7 +1369,7 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dd data-md>
      <p>Generally, <em>attestation</em> is a statement that serves to bear witness, confirm, or authenticate.
 In the WebAuthn context, <a data-link-type="dfn" href="#attestation" id="ref-for-attestation③">attestation</a> is employed to provide verifiable evidence as to the origin of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③">authenticator</a> and the data it emits. This includes such things as <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④">credential IDs</a>, <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair">credential key pairs</a>, <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter">signature counters</a>, etc.</p>
-     <p>An <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement">attestation statement</a> is provided within an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object">attestation object</a> during a <a data-link-type="dfn" href="#registration" id="ref-for-registration③">registration</a> ceremony. See also <a href="#sctn-attestation">§ 6.5 Attestation</a> and <a href="#fig-attStructs">Figure 6</a>. Whether or how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥">client</a> conveys the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①">attestation statement</a> and <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid">AAGUID</a> portions of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①">attestation object</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③">Relying Party</a> is described by <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance">attestation conveyance</a>.</p>
+     <p>An <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement">attestation statement</a> is provided within an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object">attestation object</a> during a <a data-link-type="dfn" href="#registration" id="ref-for-registration③">registration</a> ceremony. See also <a href="#sctn-attestation">§ 6.5 Attestation</a> and <a href="#fig-attStructs">Figure 6</a>. Whether or how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥">client</a> conveys the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①">attestation statement</a> and <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid">AAGUID</a> portions of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①">attestation object</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③">Relying Party</a> is described by <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance">attestation conveyance</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-certificate">Attestation Certificate</dfn>
     <dd data-md>
      <p>An X.509 Certificate for the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-key-pair">attestation key pair</dfn> used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④">authenticator</a> to attest to its manufacture
@@ -1396,29 +1410,28 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 such as <a data-link-type="dfn" href="#registration" id="ref-for-registration⑧">registration</a> or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication③">authentication</a>. By making such an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture⑧">authorization gesture</a>, a user <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③">provides
 consent</a> for (i.e., <em>authorizes</em>) a <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony③">ceremony</a> to proceed. This MAY involve <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②">user verification</a> if the
 employed <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⑤">authenticator</a> is capable, or it MAY involve a simple <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①">test of user presence</a>.</p>
-    <dt data-md><dfn data-dfn-type="dfn" data-noexport id="backup">Backup<a class="self-link" href="#backup"></a></dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="backed-up">Backed Up</dfn>
     <dd data-md>
      <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source">Public Key Credential Sources</a> may be backed up in some fashion such that they may become present on an authenticator other
-than their <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator">generating authenticator</a>. Backup can occur via mechanisms including but not limited to peer-to-peer sync, 
+than their <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator">generating authenticator</a>. Backup can occur via mechanisms including but not limited to peer-to-peer sync,
 cloud sync, local network sync, and manual import/export. See also <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="backup-eligibility">Backup Eligibility</dfn>
-    <dt data-md><dfn data-dfn-type="dfn" data-noexport id="backup-eligible">Backup Eligible<a class="self-link" href="#backup-eligible"></a></dfn>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="backup-eligible">Backup Eligible</dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①">Public Key Credential Source</a>'s <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator①">generating authenticator</a> determines at creation time whether the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②">public key credential source</a> is allowed to be <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up">backed up</a>. Backup eligibility is signaled in <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①">authenticator data</a>'s <a data-link-type="dfn" href="#flags" id="ref-for-flags">flags</a> along with the current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state">backup state</a>. 
-   Backup eligibility is a <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties">credential property</a> and is permanent for a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③">public key credential source</a>. 
-   A backup eligible <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④">public key credential source</a> is referred to as a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-device-credential">multi-device credential</dfn> whereas one that is not 
-   backup eligible is referred to as a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-device-credential">single-device credential</dfn>. See also <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
+     <p>A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①">Public Key Credential Source</a>'s <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator①">generating authenticator</a> determines at creation time whether the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②">public key credential source</a> is allowed to be <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up">backed up</a>. Backup eligibility is signaled in <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①">authenticator data</a>'s <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags">flags</a> along with the current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state">backup state</a>.
+Backup eligibility is a <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties">credential property</a> and is permanent for a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③">public key credential source</a>.
+A backup eligible <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④">public key credential source</a> is referred to as a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-device-credential">multi-device credential</dfn> whereas one that is not
+backup eligible is referred to as a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-device-credential">single-device credential</dfn>. See also <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="backup-state">Backup State</dfn>
     <dd data-md>
      <p>The current backup state of a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential">multi-device credential</a> as determined by the current <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator">managing authenticator</a>. Backup state is
-   signaled in <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②">authenticator data</a>'s <a data-link-type="dfn" href="#flags" id="ref-for-flags①">flags</a> and can change over time. See also <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility">backup eligibility</a> and <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="biometric-recognition">Biometric Recognition</dfn>
-    <dd data-md>
-     <p>The automated recognition of individuals based on their biological and behavioral characteristics <a data-link-type="biblio" href="#biblio-isobiometricvocabulary">[ISOBiometricVocabulary]</a>.</p>
+signaled in <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②">authenticator data</a>'s <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①">flags</a> and can change over time. See also <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility">backup eligibility</a> and <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="biometric-authenticator">Biometric Authenticator</dfn>
     <dd data-md>
      <p>Any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⑥">authenticator</a> that implements <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition">biometric recognition</a>.</p>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="biometric-recognition">Biometric Recognition</dfn>
+    <dd data-md>
+     <p>The automated recognition of individuals based on their biological and behavioral characteristics <a data-link-type="biblio" href="#biblio-isobiometricvocabulary">[ISOBiometricVocabulary]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="bound-credential">Bound credential</dfn>
     <dt data-md>"Authenticator <a data-link-type="dfn" href="#contains" id="ref-for-contains">contains</a> a credential"
     <dt data-md>"Credential <a data-link-type="dfn" href="#created-on" id="ref-for-created-on">created on</a> an authenticator"
@@ -1521,10 +1534,68 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-properties">Credential Properties</dfn>
     <dd data-md>
      <p>A <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties①">credential property</a> is some characteristic property of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①②">public key credential source</a>, such as whether it is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①">server-side credential</a>.</p>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-record">Credential Record</dfn>
+    <dd data-md>
+     <p>In order to implement the algorithms defined in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑦">Relying Party</a> MUST store some properties of registered <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①③">public key credential sources</a>.
+The <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record">credential record</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct">struct</a> is an abstraction of these properties stored in a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account">user account</a>.
+A credential record is created during a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①">registration ceremony</a> and used in subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③">authentication ceremonies</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑧">Relying Parties</a> MAY delete credential records as necessary or when requested by users.</p>
+     <p>The following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item">items</a> are RECOMMENDED in order to implement all steps of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a> and <a href="#sctn-verifying-assertion">§ 7.2 Verifying an Authentication Assertion</a> as defined:</p>
+     <dl>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-type">type</dfn>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type">type</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①④">public key credential source</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-id">id</dfn>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⓪">Credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑤">public key credential source</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-publickey">publicKey</dfn>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑥">credential public key</a> of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑥">public key credential source</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-signcount">signCount</dfn>
+      <dd data-md>
+       <p>The latest value of the <a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount">signature counter</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③">authenticator data</a> from any <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑥">ceremony</a> using the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑦">public key credential source</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-transports">transports</dfn>
+      <dd data-md>
+       <p>The value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports">getTransports()</a></code> when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑧">public key credential source</a> was <a data-link-type="dfn" href="#registration" id="ref-for-registration①⓪">registered</a>.</p>
+       <p class="note" role="note"><span>Note:</span> Modifying or removing <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item">items</a> from the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports①">getTransports()</a></code> could negatively impact user experience, or even prevent use of the corresponding credential.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-be">BE</dfn>
+      <dd data-md>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②">flag</a> when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑨">public key credential source</a> was created.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-bs">BS</dfn>
+      <dd data-md>
+       <p>The latest value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③">flag</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④">authenticator data</a> from any <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑦">ceremony</a> using the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⓪">public key credential source</a>.</p>
+     </dl>
+     <p>The following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①">items</a> are OPTIONAL:</p>
+     <dl>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-attestationobject">attestationObject</dfn>
+      <dd data-md>
+       <p>The value of the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject">attestationObject</a></code> attribute
+when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②①">public key credential source</a> was <a data-link-type="dfn" href="#registration" id="ref-for-registration①①">registered</a>.
+Storing this enables the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑨">Relying Party</a> to reference the credential’s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②">attestation statement</a> at a later time.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="credential record" data-dfn-type="dfn" data-noexport id="credential-record-attestationclientdatajson">attestationClientDataJSON</dfn>
+      <dd data-md>
+       <p>The value of the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson">clientDataJSON</a></code> attribute
+when the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②②">public key credential source</a> was <a data-link-type="dfn" href="#registration" id="ref-for-registration①②">registered</a>.
+Storing this in combination with the above <a data-link-type="dfn" href="#credential-record-attestationobject" id="ref-for-credential-record-attestationobject">attestationObject</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item②">item</a> enables the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⓪">Relying Party</a> to re-verify the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①">attestation signature</a> at a later time.</p>
+     </dl>
+     <p><a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn extensions</a> MAY define additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> needed to process the extension. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤①">Relying Parties</a> MAY also include any additional <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item④">items</a> as needed,
+and MAY omit any <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑤">items</a> not needed for their implementation.</p>
+     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credential-descriptor-for-a-credential-record">credential descriptor for a credential record</dfn> is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a></code> value with the contents:</p>
+     <dl>
+      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type">type</a></code>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#credential-record-type" id="ref-for-credential-record-type">type</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①">credential record</a>.</p>
+      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id">id</a></code>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#credential-record-id" id="ref-for-credential-record-id">id</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record②">credential record</a>.</p>
+      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①">transports</a></code>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#credential-record-transports" id="ref-for-credential-record-transports">transports</a> of the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record③">credential record</a>.</p>
+     </dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="generating-authenticator">Generating Authenticator</dfn>
     <dd data-md>
      <p>The Generating Authenticator is the authenticator involved in the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①">authenticatorMakeCredential</a> operation resulting
-in the creation of a given <a data-link-type="dfn">pubic key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credentials</a>, the generating authenticator may or may not be the same as the 
+in the creation of a given <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②③">public key credential source</a>. The <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator②">generating authenticator</a> is the same as the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑦">managing authenticator</a> for <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential">single-device credentials</a>. For <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential①">multi-device credentials</a>, the generating authenticator may or may not be the same as the
 current <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑧">managing authenticator</a> participating in a given <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑤">authentication</a> operation.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="human-palatability">Human Palatability</dfn>
     <dd data-md>
@@ -1532,61 +1603,61 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 users, in contrast to identifiers that are, for example, randomly generated sequences of bits <a data-link-type="biblio" href="#biblio-edupersonobjectclassspec">[EduPersonObjectClassSpec]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="non-discoverable-credential">Non-Discoverable Credential</dfn>
     <dd data-md>
-     <p>This is a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②">credential</a> whose <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⓪">credential ID</a> must be provided in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②">allowCredentials</a></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④">navigator.credentials.get()</a></code> because it is not <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential④">client-side discoverable</a>. See also <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential②">server-side credentials</a>.</p>
+     <p>This is a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②">credential</a> whose <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①①">credential ID</a> must be provided in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②">allowCredentials</a></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get④">navigator.credentials.get()</a></code> because it is not <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential④">client-side discoverable</a>. See also <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential②">server-side credentials</a>.</p>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential">Public Key Credential</dfn>
+    <dd data-md>
+     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②④">public key credential source</a>, the
+possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertion</a>. Which one is generally determined by context.</p>
+     <div class="note" role="note">
+       Note: This is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#willful-violation" id="ref-for-willful-violation">willful violation</a> of <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a>. In English, a "credential" is both a) the thing presented to prove
+    a statement and b) intended to be used multiple times. It’s impossible to achieve both criteria securely with a single
+    piece of data in a public key system. <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a> chooses to define a credential as the thing that can be used multiple
+    times (the public key), while this specification gives "credential" the English term’s flexibility. This specification
+    uses more specific terms to identify the data related to an <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a> credential: 
+      <dl>
+       <dt data-md>"Authentication information" (possibly including a private key)
+       <dd data-md>
+        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">Public key credential source</a></p>
+       <dt data-md>"Signed value"
+       <dd data-md>
+        <p><a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion④">Authentication assertion</a></p>
+       <dt data-md><a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a> "credential"
+       <dd data-md>
+        <p><a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑧">Credential public key</a> or <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②">attestation object</a></p>
+      </dl>
+     </div>
+     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑧">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤②">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤③">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
+Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> uses its stored
+copy of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⓪">credential public key</a> to verify the resultant <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑤">authentication assertion</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential-source">Public Key Credential Source</dfn>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑧">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion③">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①③">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item">items</a>:</p>
+     <p>A <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source">credential source</a> (<a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a>) used by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> to generate <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">authentication assertions</a>. A <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">public key credential source</a> consists of a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑥">items</a>:</p>
      <dl>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-type">type</dfn>
       <dd data-md>
        <p>whose value is of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype">PublicKeyCredentialType</a></code>, defaulting to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key">public-key</a></code>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-id">id</dfn>
       <dd data-md>
-       <p>A <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①①">Credential ID</a>.</p>
+       <p>A <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①②">Credential ID</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-privatekey">privateKey</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key③">credential private key</a>.</p>
+       <p>The <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key④">credential private key</a>.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-rpid">rpId</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑦">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①④">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
+       <p>The <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier">Relying Party Identifier</a>, for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a> this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">public key credential source</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑥">scoped</a> to.
 This is determined by the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id">id</a></code></code> parameter of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①">create()</a></code> operation.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-userhandle">userHandle</dfn>
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑤">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①">item</a> is
+       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①">user handle</a> associated when this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">public key credential source</a> was created. This <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑦">item</a> is
 nullable.</p>
       <dt data-md><dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-otherui">otherUI</dfn>
       <dd data-md>
-       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator④⑨">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑥">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
+       <p>OPTIONAL other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> to inform its UI. For example, this might include the user’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname">displayName</a></code>. <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui">otherUI</a> is a <dfn class="dfn-paneled" data-dfn-for="public key credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-mutable-item">mutable item</dfn> and SHOULD NOT be bound to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">public key credential source</a> in a way that prevents <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui①">otherUI</a> from being updated.</p>
      </dl>
-     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑦">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
-credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-managing-authenticator">managing authenticator</dfn> and returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑥">credential public key</a> associated with its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key④">credential
-private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑧">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑦">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion④">authentication assertions</a> created by
-this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑧">public key credential source</a>.</p>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="public-key-credential">Public Key Credential</dfn>
-    <dd data-md>
-     <p>Generically, a <em>credential</em> is data one entity presents to another in order to <em>authenticate</em> the former to the latter <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a>. The term <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①③">public key credential</a> refers to one of: a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source①⑨">public key credential source</a>, the
-possibly-<a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑤">attested</a> <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑧">credential public key</a> corresponding to a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⓪">public key credential source</a>, or an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑤">authentication assertion</a>. Which one is generally determined by context.</p>
-     <div class="note" role="note">
-       Note: This is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#willful-violation" id="ref-for-willful-violation">willful violation</a> of <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a>. In English, a "credential" is both a) the thing presented to prove
-    a statement and b) intended to be used multiple times. It’s impossible to achieve both criteria securely with a single
-    piece of data in a public key system. <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a> chooses to define a credential as the thing that can be used multiple
-    times (the public key), while this specification gives "credential" the English term’s flexibility. This specification
-    uses more specific terms to identify the data related to an <a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a> credential: 
-      <dl>
-       <dt data-md>"Authentication information" (possibly including a private key)
-       <dd data-md>
-        <p><a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②①">Public key credential source</a></p>
-       <dt data-md>"Signed value"
-       <dd data-md>
-        <p><a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑥">Authentication assertion</a></p>
-       <dt data-md><a data-link-type="biblio" href="#biblio-rfc4949">[RFC4949]</a> "credential"
-       <dd data-md>
-        <p><a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key⑨">Credential public key</a> or <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object②">attestation object</a></p>
-      </dl>
-     </div>
-     <p>At <a data-link-type="dfn" href="#registration" id="ref-for-registration①⓪">registration</a> time, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⓪">authenticator</a> creates an asymmetric key pair, and stores its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑤">private key portion</a> and information from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party④⑨">Relying Party</a> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②②">public key credential source</a>. The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⓪">public key portion</a> is returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⓪">Relying Party</a>, which then stores it in the active <a data-link-type="dfn" href="#user-account" id="ref-for-user-account">user account</a>.
-Subsequently, only that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤①">Relying Party</a>, as identified by its <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②">RP ID</a>, is able to employ the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①④">public key credential</a> in <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑥">authentication ceremonies</a>, via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑤">get()</a></code> method. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤②">Relying Party</a> uses its stored
-copy of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①①">credential public key</a> to verify the resultant <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertion</a>.</p>
+     <p>The <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential②">authenticatorMakeCredential</a> operation creates a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">public key credential source</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑥">bound</a> to a <dfn class="dfn-paneled" data-dfn-for="public key
+credential source" data-dfn-type="dfn" data-noexport id="public-key-credential-source-managing-authenticator">managing authenticator</dfn> and returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①①">credential public key</a> associated with its <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑤">credential
+private key</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Party</a> can use this <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a> to verify the <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑦">authentication assertions</a> created by
+this <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rate-limiting">Rate Limiting</dfn>
     <dd data-md>
      <p>The process (also known as throttling) by which an authenticator implements controls against brute force attacks by limiting
@@ -1597,20 +1668,30 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration">Registration</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="registration-ceremony">Registration Ceremony</dfn>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑥">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤③">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①">user account</a>.
+     <p>The <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> where a user, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Party</a>, and the user’s <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①②">client platform</a> (containing or connected to at least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤①">authenticator</a>) work in concert to create a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑤">public key credential</a> and associate it with a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a>.
 Note that this includes employing a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence②">test of user presence</a> or <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④">user verification</a>.
-After a successful <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①">registration ceremony</a>, the user can be authenticated by an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③">authentication ceremony</a>.</p>
-     <p>The WebAuthn <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②">registration ceremony</a> is defined in <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
-and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤④">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
+After a successful <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②">registration ceremony</a>, the user can be authenticated by an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④">authentication ceremony</a>.</p>
+     <p>The WebAuthn <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③">registration ceremony</a> is defined in <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>,
+and is initiated by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a> invoking a <code><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②">navigator.credentials.create()</a></code></code> operation
 with a <code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey">publicKey</a></code> argument.
 See <a href="#sctn-api">§ 5 Web Authentication API</a> for an introductory overview and <a href="#sctn-sample-registration">§ 1.3.1 Registration</a> for implementation examples.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party">Relying Party</dfn>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-relying-party">WebAuthn Relying Party</dfn>
     <dd data-md>
-     <p>See <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a>.</p>
+     <p>The entity whose <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-application">web application</dfn> utilizes the <a href="#sctn-api">Web Authentication API</a> to <a data-link-type="dfn" href="#registration" id="ref-for-registration①④">register</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑦">authenticate</a> users.</p>
+     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a> implementation typically consists of both some client-side script
+that invokes the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑦">Web Authentication API</a> in the <a data-link-type="dfn" href="#client" id="ref-for-client①④">client</a>,
+and a server-side component that executes the <a href="#sctn-rp-operations">Relying Party operations</a> and other application logic.
+Communication between the two components MUST use HTTPS or equivalent transport security,
+but is otherwise beyond the scope of this specification.</p>
+     <p class="note" role="note"><span>Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> in one
+    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑦">WebAuthn Relying Party</a> is often shortened
+    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
+    a WebAuthn context may be embedded in a broader overall context, e.g., one based on OAuth.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="relying-party-identifier">Relying Party Identifier</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rp-id">RP ID</dfn>
     <dd data-md>
-     <p>In the context of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑦">WebAuthn API</a>, a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier①">relying party identifier</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string">valid domain string</a> identifying the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑧">WebAuthn Relying Party</a> on whose behalf a given <a data-link-type="dfn" href="#registration" id="ref-for-registration①①">registration</a> or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑦">authentication ceremony</a> is being performed. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑥">public key credential</a> can only be used for <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑧">authentication</a> with the same entity (as identified by <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③">RP ID</a>) it was registered with.</p>
+     <p>In the context of the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑧">WebAuthn API</a>, a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier①">relying party identifier</a> is a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string">valid domain string</a> identifying the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑧">WebAuthn Relying Party</a> on whose behalf a given <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑤">registration</a> or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑧">authentication ceremony</a> is being performed. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑥">public key credential</a> can only be used for <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑨">authentication</a> with the same entity (as identified by <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③">RP ID</a>) it was registered with.</p>
      <p>By default, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④">RP ID</a> for a
 WebAuthn operation is set to the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain">effective domain</a>. This default MAY be
 overridden by the caller, as long as the caller-specified <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤">RP ID</a> value <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to①">is a registrable domain suffix of or is equal
@@ -1625,26 +1706,26 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
        <li data-md>
         <p>The <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised③">origin</a>'s <a data-link-type="dfn" href="https://url.spec.whatwg.org#concept-url-port" id="ref-for-concept-url-port①">port</a> is unrestricted.</p>
       </ul>
-      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑤">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>.</p>
+      <p>For example, given a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> whose origin is <code>https://login.example.com:1337</code>, then the following <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑨">RP ID</a>s are valid: <code>login.example.com</code> (default) and <code>example.com</code>, but not <code>m.login.example.com</code> and not <code>com</code>.</p>
       <p>This is done in order to match the behavior of pervasively deployed ambient credentials (e.g., cookies, <a data-link-type="biblio" href="#biblio-rfc6265">[RFC6265]</a>).
     Please note that this is a greater relaxation of "same-origin" restrictions than what <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#dom-document-domain" id="ref-for-dom-document-domain">document.domain</a>'s setter provides.</p>
       <p>These restrictions on origin values apply to <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑤">WebAuthn Clients</a>.</p>
      </div>
-     <p>Other specifications mimicking the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑧">WebAuthn API</a> to enable WebAuthn <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑧">public key credentials</a> on non-Web platforms (e.g. native mobile applications), MAY define different rules for binding a caller to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier②">Relying Party Identifier</a>. Though, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⓪">RP ID</a> syntaxes MUST conform to either <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string①">valid domain strings</a> or URIs <a data-link-type="biblio" href="#biblio-rfc3986">[RFC3986]</a> <a data-link-type="biblio" href="#biblio-url">[URL]</a>.</p>
+     <p>Other specifications mimicking the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑨">WebAuthn API</a> to enable WebAuthn <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑧">public key credentials</a> on non-Web platforms (e.g. native mobile applications), MAY define different rules for binding a caller to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier②">Relying Party Identifier</a>. Though, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⓪">RP ID</a> syntaxes MUST conform to either <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain-string" id="ref-for-valid-domain-string①">valid domain strings</a> or URIs <a data-link-type="biblio" href="#biblio-rfc3986">[RFC3986]</a> <a data-link-type="biblio" href="#biblio-url">[URL]</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-public-key-credential-source">Server-side Public Key Credential Source</dfn>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential">Server-side Credential</dfn>
     <dt data-md>[DEPRECATED] <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="non-resident-credential">Non-Resident Credential</dfn>
     <dd data-md>
      <p class="note" role="note"><span>Note:</span> Historically, <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential③">server-side credentials</a> have been known as <a data-link-type="dfn" href="#non-resident-credential" id="ref-for-non-resident-credential">non-resident credentials</a>.
-For backwards compatibility purposes, the various <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api⑨">WebAuthn API</a> and <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model①">Authenticator Model</a> components
+For backwards compatibility purposes, the various <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⓪">WebAuthn API</a> and <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model①">Authenticator Model</a> components
 with various forms of <code>resident</code> within their names have not been changed.</p>
      <p>A <a data-link-type="dfn" href="#server-side-public-key-credential-source" id="ref-for-server-side-public-key-credential-source①">Server-side Public Key Credential Source</a>, or <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential④">Server-side Credential</a> for short,
-is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②③">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑥">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①②">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑦">Relying Party</a> must
+is a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a> that is only usable in an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤">authentication ceremony</a> when the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a> supplies its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential ID</a> in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑥">navigator.credentials.get()</a></code>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">allowCredentials</a></code> argument. This means that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> must
 manage the credential’s storage and discovery, as well as be able to first identify the user in order to
-discover the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①③">credential IDs</a> to supply in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑦">navigator.credentials.get()</a></code> call.</p>
-     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side①">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②④">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
+discover the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①④">credential IDs</a> to supply in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑦">navigator.credentials.get()</a></code> call.</p>
+     <p><a data-link-type="dfn" href="#client-side" id="ref-for-client-side①">Client-side</a> storage of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a> is not required for a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑤">server-side credential</a>.
 This is in contrast to a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑤">client-side discoverable credential</a>,
-which instead does not require the user to first be identified in order to provide the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①④">credential ID</a>s
+which instead does not require the user to first be identified in order to provide the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑤">credential ID</a>s
 to a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get⑧">navigator.credentials.get()</a></code> call.</p>
      <p>See also: <a data-link-type="dfn" href="#server-side-credential-storage-modality" id="ref-for-server-side-credential-storage-modality">server-side credential storage modality</a> and <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential①">non-discoverable credential</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="test-of-user-presence">Test of User Presence</dfn>
@@ -1657,35 +1738,39 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-account">User Account</dfn>
     <dd data-md>
      <p>In the context of this specification,
-a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑧">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑤⑨">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⓪">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②">user handle</a>.
+a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③">user account</a> denotes the mapping of a set of <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential③">credentials</a> <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> to a (sub)set of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a>'s resources, as maintained and authorized by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a> maps a given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential①⑨">public key credential</a> to a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④">user account</a> by assigning a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a>-specific value to the credential’s <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②">user handle</a> and storing a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record④">credential record</a> for the credential in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user account</a>.
 This mapping, the set of credentials, and their authorizations, may evolve over time.
-A given <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑤">user account</a> might be accessed by one or more natural persons (also known as "users"),
-and one natural person might have access to one or more <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑥">user accounts</a>,
-depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥①">Relying Party</a>.</p>
+A given <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑦">user account</a> might be accessed by one or more natural persons (also known as "users"),
+and one natural person might have access to one or more <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑧">user accounts</a>,
+depending on actions of the user(s) and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-consent">User Consent</dfn>
     <dd data-md>
      <p>User consent means the user agrees with what they are being asked, i.e., it encompasses reading and understanding prompts.
-An <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①①">authorization gesture</a> is a <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑦">ceremony</a> component often employed to indicate <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent④">user consent</a>.</p>
+An <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①①">authorization gesture</a> is a <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑨">ceremony</a> component often employed to indicate <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent④">user consent</a>.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-handle">User Handle</dfn>
     <dd data-md>
-     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑦">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥②">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①②">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②">Discoverable credentials</a> store this identifier and return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑤">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
-     <p>The main use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> is to identify the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑧">user account</a> in such <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥">authentication ceremonies</a>,
-but the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑤">credential ID</a> could be used instead.
+     <p>A user handle is an identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>, specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a> as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id">id</a></code></code> during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>. <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential②">Discoverable credentials</a> store this identifier and return it as <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle①">userHandle</a></code></code> in <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑥">authentication ceremonies</a> started with an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty">empty</a> <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">allowCredentials</a></code></code> argument.</p>
+     <p>The main use of the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle③">user handle</a> is to identify the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⓪">user account</a> in such <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremonies</a>,
+but the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑥">credential ID</a> could be used instead.
 The main differences are
-that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑥">credential ID</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤③">authenticator</a> and unique for each credential,
-while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle④">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥③">Relying Party</a> and ought to be the same
-for all <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> registered to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account⑨">user account</a>.</p>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤④">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑤">public key credential sources</a>.
-As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥④">Relying Party</a>.</p>
+that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑦">credential ID</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤③">authenticator</a> and unique for each credential,
+while the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle④">user handle</a> is chosen by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Party</a> and ought to be the same
+for all <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential④">credentials</a> registered to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①①">user account</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤④">Authenticators</a> <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map">map</a> pairs of <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①①">RP ID</a> and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑤">user handle</a> to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential sources</a>.
+As a consequence, an authenticator will store at most one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential③">discoverable credential</a> per <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑥">user handle</a> per <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Party</a>.</p>
      <p>A user handle is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence①">byte sequence</a> with a maximum size of 64 bytes, and is not meant to be displayed to the user.
 It MUST NOT contain personally identifying information, see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
+    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="concept-user-present">User Present</dfn>
+    <dd data-md>
+     <p>Upon successful completion of a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑤">user presence test</a>, the user is said to be
+"<a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present">present</a>".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-verification">User Verification</dfn>
     <dd data-md>
      <p>The technical process by which an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑤">authenticator</a> <em>locally authorizes</em> the invocation of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential③">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①">authenticatorGetAssertion</a> operations. <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑥">User verification</a> MAY be instigated
 through various <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①②">authorization gesture</a> modalities; for example, through a touch plus pin code, password entry, or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition②">biometric recognition</a> (e.g., presenting a fingerprint) <a data-link-type="biblio" href="#biblio-isobiometricvocabulary">[ISOBiometricVocabulary]</a>. The intent is to
 distinguish individual users.</p>
-     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑦">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑤">Relying Party</a> a concrete identification of the user,
+     <p>Note that <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑦">user verification</a> does not give the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a> a concrete identification of the user,
 but when 2 or more ceremonies with <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑧">user verification</a> have been done with that <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑤">credential</a> it expresses that it was the same user that performed all of them.
 The same user might not always be the same natural person, however,
 if multiple natural persons share access to the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑥">authenticator</a>.</p>
@@ -1693,39 +1778,21 @@ <h2 class="heading settled" data-level="4" id="sctn-terminology"><span class="se
 and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑦">authenticator</a>'s capabilities.
 For example, some devices are intended to be used by a single individual,
 yet they may allow multiple natural persons to enroll fingerprints or know the same PIN
-and thus access the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⓪">user account</a>(s) using that device.</p>
+and thus access the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①②">user account</a>(s) using that device.</p>
      <div class="note" role="note">
        Note: Invocation of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential④">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion②">authenticatorGetAssertion</a> operations
     implies use of key material managed by the authenticator. 
       <p>Also, for security, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑨">user verification</a> and use of <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑥">credential private keys</a> must all occur within the logical security boundary defining the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑧">authenticator</a>.</p>
      </div>
      <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⓪">User verification</a> procedures MAY implement <a data-link-type="dfn" href="#rate-limiting" id="ref-for-rate-limiting①">rate limiting</a> as a protection against brute force attacks.</p>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="concept-user-present">User Present</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="up">UP</dfn>
-    <dd data-md>
-     <p>Upon successful completion of a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑤">user presence test</a>, the user is said to be
-"<a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present">present</a>".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="concept-user-verified">User Verified</dfn>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="uv">UV</dfn>
     <dd data-md>
      <p>Upon successful completion of a <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①①">user verification</a> process, the user is said to be "<a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified">verified</a>".</p>
-    <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-relying-party">WebAuthn Relying Party</dfn>
-    <dd data-md>
-     <p>The entity whose <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-application">web application</dfn> utilizes the <a href="#sctn-api">Web Authentication API</a> to <a data-link-type="dfn" href="#registration" id="ref-for-registration①③">register</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication⑨">authenticate</a> users.</p>
-     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑥">Relying Party</a> implementation typically consists of both some client-side script
-that invokes the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⓪">Web Authentication API</a> in the <a data-link-type="dfn" href="#client" id="ref-for-client①④">client</a>,
-and a server-side component that executes the <a href="#sctn-rp-operations">Relying Party operations</a> and other application logic.
-Communication between the two components MUST use HTTPS or equivalent transport security,
-but is otherwise beyond the scope of this specification.</p>
-     <p class="note" role="note"><span>Note:</span> While the term <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑦">Relying Party</a> is also often used in other contexts (e.g., X.509 and OAuth), an entity acting as a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑧">Relying Party</a> in one
-    context is not necessarily a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑥⑨">Relying Party</a> in other contexts. In this specification, the term <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> is often shortened
-    to be just <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⓪">Relying Party</a>, and explicitly refers to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦①">Relying Party</a> in the WebAuthn context. Note that in any concrete instantiation
-    a WebAuthn context may be embedded in a broader overall context, e.g., one based on OAuth.</p>
    </dl>
    <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="web-authentication-api">Web Authentication API</dfn></span><a class="self-link" href="#sctn-api"></a></h2>
    <p>This section normatively specifies the API for creating and using <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⓪">public key credentials</a>. The basic
-idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator③">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⓪">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦②">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
-browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦③">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
+idea is that the credentials belong to the user and are <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator⑨">managed</a> by a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator③">WebAuthn Authenticator</a>, with which the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑨">WebAuthn Relying Party</a> interacts through the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①④">client platform</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a> scripts can (with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑤">user’s consent</a>) request the
+browser to create a new credential for future use by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a>. See <a href="#fig-registration">Figure <span class="figure-num-following"></span></a>, below.</p>
    <figure id="fig-registration">
      <img src="images/webauthn-registration-flow-01.svg"> 
     <figcaption>Registration Flow</figcaption>
@@ -1749,12 +1816,12 @@ <h2 class="heading settled" data-level="5" id="sctn-api"><span class="secno">5.
 a different <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑤">origin</a>, by incorporating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑥">origin</a> in its responses. Specifically, as defined in <a href="#sctn-authenticator-ops">§ 6.3 Authenticator Operations</a>,
 the full <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑦">origin</a> of the requester is included, and signed over, in the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object③">attestation object</a> produced when a new credential
 is created as well as in all assertions produced by WebAuthn credentials.</p>
-   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦④">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
-credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑤">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
-Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑨">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⓪">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑥">Relying Party</a> can only be used in operations
+   <p>Additionally, to maintain user privacy and prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Parties</a> from probing for the presence of <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②①">public key
+credentials</a> belonging to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Parties</a>, each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②②">credential</a> is also <a data-link-type="dfn" href="#scope" id="ref-for-scope⑧">scoped</a> to a <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier③">Relying Party
+Identifier</a>, or <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①②">RP ID</a>. This <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①③">RP ID</a> is provided by the client to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑤⑨">authenticator</a> for all operations, and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⓪">authenticator</a> ensures that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②③">credentials</a> created by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a> can only be used in operations
 requested by the same <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①④">RP ID</a>. Separating the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑧">origin</a> from the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑤">RP ID</a> in this way allows the API to be used in cases
-where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑦">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origins</a>.</p>
-   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑧">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for
+where a single <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Party</a> maintains multiple <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin⑨">origins</a>.</p>
+   <p>The client facilitates these security measures by providing the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①⓪">origin</a> and <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑥">RP ID</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥①">authenticator</a> for
 each operation. Since this is an integral part of the WebAuthn security model, user agents only expose this API to callers in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context">secure contexts</a>.
 For web contexts in particular,
 this only includes those accessed via a secure transport (e.g., TLS) established without errors.</p>
@@ -1769,11 +1836,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
      <div class="support">
       <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
       <hr>
-      <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+      <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
       <hr>
       <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
       <hr>
-      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>49+</span></span>
+      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>?</span></span>
      </div>
     </div>
    </div>
@@ -1785,6 +1852,8 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject①"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse"><c- n>AuthenticatorResponse</c-></a>    <a class="idl-code" data-link-type="attribute" data-readonly data-type="AuthenticatorResponse" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response①"><c- g>response</c-></a>;
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject②"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①"><c- b>DOMString</c-></a>?               <a class="idl-code" data-link-type="attribute" data-readonly data-type="DOMString?" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment"><c- g>authenticatorAttachment</c-></a>;
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs"><c- n>AuthenticationExtensionsClientOutputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="getClientExtensionResults()" id="dom-publickeycredential-getclientextensionresults"><code><c- g>getClientExtensionResults</c-></code></dfn>();
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise①"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isConditionalMediationAvailable()" id="dom-publickeycredential-isconditionalmediationavailable"><code><c- g>isConditionalMediationAvailable</c-></code></dfn>();
+    <a data-link-type="idl-name" href="#typedefdef-publickeycredentialjson" id="ref-for-typedefdef-publickeycredentialjson"><c- n>PublicKeyCredentialJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="toJSON()" id="dom-publickeycredential-tojson"><code><c- g>toJSON</c-></code></dfn>();
 };
 </pre>
    <dl>
@@ -1801,11 +1870,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
        <div class="support">
         <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
         <hr>
-        <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+        <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
         <hr>
         <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
         <hr>
-        <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>49+</span></span>
+        <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>?</span></span>
        </div>
       </div>
      </div>
@@ -1821,11 +1890,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
        <div class="support">
         <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
         <hr>
-        <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+        <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
         <hr>
         <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
         <hr>
-        <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>49+</span></span>
+        <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>?</span></span>
        </div>
       </div>
      </div>
@@ -1838,11 +1907,11 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②">DOMString</a>, readonly, nullable</span>
     <dd data-md>
      <p>This attribute reports the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality">authenticator attachment modality</a> in effect at the time the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create④">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⓪">navigator.credentials.get()</a></code> methods successfully complete.
-The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑦⑨">Relying Parties</a> SHOULD treat unknown values
+The attribute’s value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment">AuthenticatorAttachment</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Parties</a> SHOULD treat unknown values
 as if the value were null.</p>
      <div class="note" role="note">
-       Note: If, as the result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony③">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑦">authentication ceremony</a>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment①">authenticatorAttachment</a></code>'s value is "cross-platform" and
-concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑧">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⓪">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
+       Note: If, as the result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremony</a>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment①">authenticatorAttachment</a></code>'s value is "cross-platform" and
+concurrently <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable" id="ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable</a></code> returns <code>true</code>, then the user employed a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑥">roaming authenticator</a> for this <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a> while there is an available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators⑨">platform authenticator</a>. Thus the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Party</a> has the opportunity to prompt the user to register the available <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⓪">platform authenticator</a>, which may enable more streamlined user experience flows. 
       <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥③">authenticator’s</a> <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①">attachment modality</a> could change over time.
 For example, a mobile phone might at one time only support <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment">platform attachment</a> but later receive updates to support <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment">cross-platform attachment</a> as well.</p>
      </div>
@@ -1855,39 +1924,95 @@ <h3 class="heading settled" data-level="5.1" id="iface-pkcredential"><span class
        <div class="support">
         <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
         <hr>
-        <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+        <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
         <hr>
         <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
         <hr>
-        <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>49+</span></span>
+        <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>?</span></span>
        </div>
       </div>
      </div>
      <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults">getClientExtensionResults()</a></code></p>
     <dd data-md>
      <p>This operation returns the value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot">[[clientExtensionsResults]]</a></code>, which is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map">map</a> containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier">extension identifier</a> → <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output">client extension output</a> entries produced by the extension’s <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing">client extension processing</a>.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable">isConditionalMediationAvailable()</a></code>
+    <dd data-md>
+     <p><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑥">PublicKeyCredential</a></code> overrides this method to indicate availability for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional">conditional</a></code> mediation. <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⓪">WebAuthn Relying Parties</a> SHOULD verify availability before attempting to set <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①">conditional</a></code>.</p>
+     <p>Upon invocation, a promise is returned that resolves with a value of <code>true</code> if <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional②">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated">user mediation</a> is available, or <code>false</code> otherwise.</p>
+     <p>This method has no arguments and returns a promise to a Boolean value.</p>
+     <p class="note" role="note"><span>Note:</span> If this method is not present, <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional③">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated①">user mediation</a> is not available.</p>
+    <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-tojson" id="ref-for-dom-publickeycredential-tojson">toJSON()</a></code>
+    <dd data-md>
+     <p>This operation returns <code class="idl"><a data-link-type="idl" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson">RegistrationResponseJSON</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson">AuthenticationResponseJSON</a></code>,
+which are <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types">JSON type</a> representations mirroring <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code>, suitable for submission to a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Party</a> server as an <code>application/json</code> payload. The <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> is in charge of <a href="https://webidl.spec.whatwg.org/#idl-tojson-operation">serializing values to JSON types as usual</a>,
+but MUST take additional steps to first encode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②">ArrayBuffer</a></code> values to <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③">DOMString</a></code> values
+using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①">base64url encoding</a>.</p>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-registrationresponsejson-clientextensionresults" id="ref-for-dom-registrationresponsejson-clientextensionresults">RegistrationResponseJSON.clientExtensionResults</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationresponsejson-clientextensionresults" id="ref-for-dom-authenticationresponsejson-clientextensionresults">AuthenticationResponseJSON.clientExtensionResults</a></code> member MUST be set to the output of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults①">getClientExtensionResults()</a></code>,
+with any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③">ArrayBuffer</a></code> values encoded to <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④">DOMString</a></code> values using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②">base64url encoding</a>. This MAY include <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer④">ArrayBuffer</a></code> values from extensions registered
+in the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> but not
+defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
+     <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponsejson-transports" id="ref-for-dom-authenticatorattestationresponsejson-transports">AuthenticatorAttestationResponseJSON.transports</a></code> member MUST be set to the output of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports②">getTransports()</a></code>.</p>
+   </dl>
+<pre class="idl highlight def"><c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤"><c- b>DOMString</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-base64urlstring"><code><c- g>Base64URLString</c-></code></dfn>;
+<c- b>typedef</c-> (<a data-link-type="idl-name" href="#dictdef-registrationresponsejson" id="ref-for-dictdef-registrationresponsejson①"><c- n>RegistrationResponseJSON</c-></a> <c- b>or</c-> <a data-link-type="idl-name" href="#dictdef-authenticationresponsejson" id="ref-for-dictdef-authenticationresponsejson①"><c- n>AuthenticationResponseJSON</c-></a>) <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></dfn>;
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-registrationresponsejson"><code><c- g>RegistrationResponseJSON</c-></code></dfn> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-registrationresponsejson-id"><code><c- g>id</c-></code><a class="self-link" href="#dom-registrationresponsejson-id"></a></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-registrationresponsejson-rawid"><code><c- g>rawId</c-></code><a class="self-link" href="#dom-registrationresponsejson-rawid"></a></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticatorattestationresponsejson" id="ref-for-dictdef-authenticatorattestationresponsejson"><c- n>AuthenticatorAttestationResponseJSON</c-></a> <dfn class="idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticatorAttestationResponseJSON " id="dom-registrationresponsejson-response"><code><c- g>response</c-></code><a class="self-link" href="#dom-registrationresponsejson-response"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥"><c- b>DOMString</c-></a>?  <dfn class="idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString?  " id="dom-registrationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code><a class="self-link" href="#dom-registrationresponsejson-authenticatorattachment"></a></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputsjson" id="ref-for-dictdef-authenticationextensionsclientoutputsjson"><c- n>AuthenticationExtensionsClientOutputsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientOutputsJSON " id="dom-registrationresponsejson-clientextensionresults"><code><c- g>clientExtensionResults</c-></code></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦"><c- b>DOMString</c-></a> <dfn class="idl-code" data-dfn-for="RegistrationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString " id="dom-registrationresponsejson-type"><code><c- g>type</c-></code><a class="self-link" href="#dom-registrationresponsejson-type"></a></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorattestationresponsejson"><code><c- g>AuthenticatorAttestationResponseJSON</c-></code></dfn> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring②"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticatorattestationresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code><a class="self-link" href="#dom-authenticatorattestationresponsejson-clientdatajson"></a></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring③"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticatorattestationresponsejson-attestationobject"><code><c- g>attestationObject</c-></code><a class="self-link" href="#dom-authenticatorattestationresponsejson-attestationobject"></a></dfn>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧"><c- b>DOMString</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponseJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString> " id="dom-authenticatorattestationresponsejson-transports"><code><c- g>transports</c-></code></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationresponsejson"><code><c- g>AuthenticationResponseJSON</c-></code></dfn> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring④"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticationresponsejson-id"><code><c- g>id</c-></code><a class="self-link" href="#dom-authenticationresponsejson-id"></a></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑤"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticationresponsejson-rawid"><code><c- g>rawId</c-></code><a class="self-link" href="#dom-authenticationresponsejson-rawid"></a></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticatorassertionresponsejson" id="ref-for-dictdef-authenticatorassertionresponsejson"><c- n>AuthenticatorAssertionResponseJSON</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticatorAssertionResponseJSON " id="dom-authenticationresponsejson-response"><code><c- g>response</c-></code><a class="self-link" href="#dom-authenticationresponsejson-response"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑨"><c- b>DOMString</c-></a>?  <dfn class="idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString?  " id="dom-authenticationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code><a class="self-link" href="#dom-authenticationresponsejson-authenticatorattachment"></a></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputsjson" id="ref-for-dictdef-authenticationextensionsclientoutputsjson①"><c- n>AuthenticationExtensionsClientOutputsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientOutputsJSON " id="dom-authenticationresponsejson-clientextensionresults"><code><c- g>clientExtensionResults</c-></code></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⓪"><c- b>DOMString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationResponseJSON" data-dfn-type="dict-member" data-export data-type="DOMString " id="dom-authenticationresponsejson-type"><code><c- g>type</c-></code><a class="self-link" href="#dom-authenticationresponsejson-type"></a></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorassertionresponsejson"><code><c- g>AuthenticatorAssertionResponseJSON</c-></code></dfn> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑥"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticatorassertionresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code><a class="self-link" href="#dom-authenticatorassertionresponsejson-clientdatajson"></a></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑦"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticatorassertionresponsejson-authenticatordata"><code><c- g>authenticatorData</c-></code><a class="self-link" href="#dom-authenticatorassertionresponsejson-authenticatordata"></a></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑧"><c- n>Base64URLString</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString " id="dom-authenticatorassertionresponsejson-signature"><code><c- g>signature</c-></code><a class="self-link" href="#dom-authenticatorassertionresponsejson-signature"></a></dfn>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring⑨"><c- n>Base64URLString</c-></a>? <dfn class="idl-code" data-dfn-for="AuthenticatorAssertionResponseJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString? " id="dom-authenticatorassertionresponsejson-userhandle"><code><c- g>userHandle</c-></code><a class="self-link" href="#dom-authenticatorassertionresponsejson-userhandle"></a></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientoutputsjson"><code><c- g>AuthenticationExtensionsClientOutputsJSON</c-></code></dfn> {
+};
+</pre>
+   <dl>
     <dt data-md><dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-type-slot"><code>[[type]]</code><a class="self-link" href="#dom-publickeycredential-type-slot"></a></dfn>
     <dd data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑥">PublicKeyCredential</a></code> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object">interface object</a>'s <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot" id="ref-for-dom-credential-type-slot">[[type]]</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots②">internal slot</a>'s value is the string
+     <p>The <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑧">PublicKeyCredential</a></code> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object">interface object</a>'s <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot" id="ref-for-dom-credential-type-slot">[[type]]</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots②">internal slot</a>'s value is the string
 "<code>public-key</code>".</p>
      <p class="note" role="note"><span>Note:</span> This is reflected via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type">type</a></code> attribute getter inherited from <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential⑤">Credential</a></code>.</p>
     <dt data-md><dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-discovery-slot"><code>[[discovery]]</code><a class="self-link" href="#dom-publickeycredential-discovery-slot"></a></dfn>
     <dd data-md>
-     <p>The <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑦">PublicKeyCredential</a></code> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object①">interface object</a>'s <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot" id="ref-for-dom-credential-discovery-slot">[[discovery]]</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots③">internal slot</a>'s value is
+     <p>The <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑨">PublicKeyCredential</a></code> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object①">interface object</a>'s <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot" id="ref-for-dom-credential-discovery-slot">[[discovery]]</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots③">internal slot</a>'s value is
 "<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote" id="ref-for-dom-credential-discovery-remote">remote</a></code>".</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-identifier-slot"><code>[[identifier]]</code></dfn>
     <dd data-md>
-     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots④">internal slot</a> contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑦">credential ID</a>, chosen by the authenticator.
-The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑧">credential ID</a> is used to look up credentials for use, and is therefore expected to be globally unique
+     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots④">internal slot</a> contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑧">credential ID</a>, chosen by the authenticator.
+The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑨">credential ID</a> is used to look up credentials for use, and is therefore expected to be globally unique
 with high probability across all credentials of the same type, across all authenticators.</p>
      <p class="note" role="note"><span>Note:</span> This API does not constrain
 the format or length of this identifier, except that it MUST be sufficient for the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥④">authenticator</a> to uniquely select a key.
 For example, an authenticator without on-board storage may create identifiers containing a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑦">credential private key</a> wrapped with a symmetric key that is burned into the authenticator.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="attribute" data-export id="dom-publickeycredential-clientextensionsresults-slot"><code>[[clientExtensionsResults]]</code></dfn>
     <dd data-md>
-     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧①">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧②">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①①">navigator.credentials.get()</a></code>.</p>
+     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑤">internal slot</a> contains the results of processing client extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Party</a> upon the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a>'s invocation of either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑤">navigator.credentials.create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①①">navigator.credentials.get()</a></code>.</p>
    </dl>
-   <p><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑧">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object②">interface object</a> inherits <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential⑥">Credential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#collectfromcredentialstore-origin-options-sameoriginwithancestors" id="ref-for-collectfromcredentialstore-origin-options-sameoriginwithancestors">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, and defines its own
+   <p><code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⓪">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object②">interface object</a> inherits <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credential" id="ref-for-credential⑥">Credential</a></code>'s implementation of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#collectfromcredentialstore-origin-options-sameoriginwithancestors" id="ref-for-collectfromcredentialstore-origin-options-sameoriginwithancestors">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a></code>, and defines its own
 implementation of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>, and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#store-credential-sameoriginwithancestors" id="ref-for-store-credential-sameoriginwithancestors">[[Store]](credential, sameOriginWithAncestors)</a></code>.</p>
    <h4 class="heading settled" data-level="5.1.1" id="sctn-credentialcreationoptions-extension"><span class="secno">5.1.1. </span><span class="content"><code>CredentialCreationOptions</code> Dictionary Extension</span><a class="self-link" href="#sctn-credentialcreationoptions-extension"></a></h4>
    <p>To support registration via <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑥">navigator.credentials.create()</a></code>, this document extends
@@ -1904,8 +2029,8 @@ <h4 class="heading settled" data-level="5.1.2" id="sctn-credentialrequestoptions
 </pre>
    <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span class="secno">5.1.3. </span><span class="content">Create a New Credential - PublicKeyCredential’s <code>[[Create]](origin, options, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-createCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Create]](origin, options, sameOriginWithAncestors)">
-     <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential⑨">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="[[Create]](origin, options, sameOriginWithAncestors)" id="dom-publickeycredential-create-slot"><code>[[Create]](origin,
-options, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑦">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑥">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑤">authenticator</a>. This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller">AbortController</a></code>;
+     <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①①">PublicKeyCredential</a></code>'s <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-interface-object" id="ref-for-dfn-interface-object③">interface object</a>'s implementation of the <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="[[Create]](origin, options, sameOriginWithAncestors)" id="dom-publickeycredential-create-slot"><code>[[Create]](origin,
+options, sameOriginWithAncestors)</code></dfn> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑥">internal method</a> <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①①">WebAuthn Relying Party</a> scripts to call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑦">navigator.credentials.create()</a></code> to request the creation of a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a>, <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑦">bound</a> to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑤">authenticator</a>. This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create⑧">navigator.credentials.create()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions. 
     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑦">internal method</a> accepts three arguments:</p>
     <dl>
@@ -1920,7 +2045,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
      <dd data-md>
       <p>This argument is a Boolean value which is <code>true</code> if and only if the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object" id="ref-for-environment-settings-object">environment settings object</a> is <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors">same-origin with its ancestors</a>. It is <code>false</code> if caller is cross-origin.</p>
     </dl>
-    <p class="note" role="note"><span>Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise①">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⓪">navigator.credentials.create()</a></code>.</p>
+    <p class="note" role="note"><span>Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise②">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⓪">navigator.credentials.create()</a></code>.</p>
     <p class="note" role="note"><span>Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
 avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-reference" id="ref-for-dfn-get-buffer-source-reference">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
@@ -1935,8 +2060,8 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
       <p>Let <var>options</var> be the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey③">publicKey</a></code></code>.</p>
      <li data-md>
       <p>If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout">timeout</a></code> member of <var>options</var> is present, check if its value lies within a
-reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑤">client</a> and if not, correct it to the closest value lying within that range. Set a timer <var>lifetimeTimer</var> to this adjusted value. If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout①">timeout</a></code> member of <var>options</var> is not
-present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a>-specific default.</p>
+reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑥">client</a> and if not, correct it to the closest value lying within that range. Set a timer <var>lifetimeTimer</var> to this adjusted value. If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout①">timeout</a></code> member of <var>options</var> is not
+present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client①⑦">client</a>-specific default.</p>
       <p>Recommended ranges and defaults for the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout②">timeout</a></code> member of <var>options</var> are as follows.
       If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification">userVerification</a></code></code></p>
       <dl class="switch">
@@ -1980,7 +2105,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
       <p class="note" role="note"><span>Note:</span> <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp④">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id④">id</a></code></code> represents the
         caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑦">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑧">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin③">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑦">effective domain</a> unless the caller has explicitly set <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑤">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑤">id</a></code></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①①">create()</a></code>.</p>
      <li data-md>
-      <p>Let <var>credTypesAndPubKeyAlgs</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item">items</a> are pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①">PublicKeyCredentialType</a></code> and
+      <p>Let <var>credTypesAndPubKeyAlgs</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①">items</a> are pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①">PublicKeyCredentialType</a></code> and
 a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier">COSEAlgorithmIdentifier</a></code>.</p>
      <li data-md>
       <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams">pubKeyCredParams</a></code></code>’s <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-size" id="ref-for-list-size">size</a></p>
@@ -2022,7 +2147,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
        <li data-md>
         <p>Let <var>authenticatorExtensionInput</var> be the (<a data-link-type="dfn" href="#cbor" id="ref-for-cbor②">CBOR</a>) result of running <var>extensionId</var>’s <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing①">client extension processing</a> algorithm on <var>clientExtensionInput</var>. If the algorithm returned an error, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue③">continue</a>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set①">Set</a> <var>authenticatorExtensions</var>[<var>extensionId</var>] to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①">base64url encoding</a> of <var>authenticatorExtensionInput</var>.</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set①">Set</a> <var>authenticatorExtensions</var>[<var>extensionId</var>] to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③">base64url encoding</a> of <var>authenticatorExtensionInput</var>.</p>
       </ol>
      <li data-md>
       <p>Let <var>collectedClientData</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata">CollectedClientData</a></code> instance whose fields are:</p>
@@ -2032,7 +2157,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
         <p>The string "webauthn.create".</p>
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge">challenge</a></code>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②">base64url encoding</a> of <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge">challenge</a></code>.</p>
+        <p>The <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding④">base64url encoding</a> of <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge">challenge</a></code>.</p>
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin">origin</a></code>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#ascii-serialisation-of-an-origin" id="ref-for-ascii-serialisation-of-an-origin">serialization of</a> <var>callerOrigin</var>.</p>
@@ -2050,9 +2175,9 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
      <li data-md>
       <p>Let <var>issuedRequests</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set">ordered set</a>.</p>
      <li data-md>
-      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑦">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑧">client platform</a> at that instant.</p>
+      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set①">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑦">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item②">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑥">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑧">client platform</a> at that instant.</p>
       <p class="note" role="note"><span>Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑦">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑧">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
-or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑦">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client①⑧">client</a>.</p>
+or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client①⑧">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client①⑨">client</a>.</p>
      <li data-md>
       <p>Start <var>lifetimeTimer</var>.</p>
      <li data-md>
@@ -2114,7 +2239,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
              <dt data-md>is capable of <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality①">client-side credential storage modality</a>
              <dd data-md>
               <p>Let <var>requireResidentKey</var> be <code>true</code>.</p>
-             <dt data-md>is not capable of <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality②">client-side credential storage modality</a>, or if the <a data-link-type="dfn" href="#client" id="ref-for-client①⑨">client</a> cannot determine authenticator capability,
+             <dt data-md>is not capable of <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality②">client-side credential storage modality</a>, or if the <a data-link-type="dfn" href="#client" id="ref-for-client②⓪">client</a> cannot determine authenticator capability,
              <dd data-md>
               <p>Let <var>requireResidentKey</var> be <code>false</code>.</p>
             </dl>
@@ -2163,10 +2288,10 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate⑤">For each</a> credential descriptor <var>C</var> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials">excludeCredentials</a></code></code>:</p>
           <ol>
            <li data-md>
-            <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①">transports</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty③">is not empty</a>, and <var>authenticator</var> is connected over a transport not
-mentioned in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports②">transports</a></code></code>, the client MAY <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue⑧">continue</a>.</p>
+            <p>If <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports②">transports</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty③">is not empty</a>, and <var>authenticator</var> is connected over a transport not
+mentioned in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports③">transports</a></code></code>, the client MAY <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue⑧">continue</a>.</p>
             <p class="note" role="note"><span>Note:</span> If the client chooses to <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue⑨">continue</a>, this could result in
-inadvertently registering multiple credentials <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑧">bound to</a> the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑨">authenticator</a> if the transport hints in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports③">transports</a></code></code> are not accurate.
+inadvertently registering multiple credentials <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑧">bound to</a> the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑥⑨">authenticator</a> if the transport hints in <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports④">transports</a></code></code> are not accurate.
 For example, stored transport hints could become inaccurate
 as a result of software upgrades adding new connectivity options.</p>
            <li data-md>
@@ -2203,11 +2328,11 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
           <p>Throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror①">InvalidStateError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑦">DOMException</a></code>.</p>
         </ol>
         <p class="note" role="note"><span>Note:</span> This error status is handled separately because the <var>authenticator</var> returns it only if <var>excludeCredentialDescriptorList</var> identifies a credential <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential⑨">bound</a> to the <var>authenticator</var> and the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑥">consented</a> to the operation. Given this explicit consent, it is acceptable for this case to be
-distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧③">Relying Party</a>.</p>
+distinguishable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a>.</p>
        <dt data-md>If any <var>authenticator</var> returns an error status not equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror②">InvalidStateError</a></code>",
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑧">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
-        <p class="note" role="note"><span>Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧④">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
+        <p class="note" role="note"><span>Note:</span> This case does not imply <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑦">user consent</a> for the operation, so details about the error are hidden from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a> in order to prevent leak of potentially identifying information. See <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> for
 details.</p>
        <dt data-md>If any <var>authenticator</var> indicates success,
        <dd data-md>
@@ -2215,7 +2340,7 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove⑨">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>. This authenticator is now the <dfn class="dfn-paneled" data-dfn-for="create" data-dfn-type="dfn" data-noexport id="create-selected-authenticator">selected authenticator</dfn>.</p>
          <li data-md>
-          <p>Let <var>credentialCreationData</var> be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct①">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item②">items</a> are:</p>
+          <p>Let <var>credentialCreationData</var> be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct②">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑧">items</a> are:</p>
           <dl>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="credentialCreationData" data-dfn-type="dfn" data-noexport id="credentialcreationdata-attestationobjectresult">attestationObjectResult</dfn></code>
            <dd data-md>
@@ -2243,31 +2368,31 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
 same:</p>
               <ol>
                <li data-md>
-                <p>If the <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid①">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data">attested credential data</a> is 16 zero bytes, <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult">attestationObjectResult</a>.fmt</code> is "packed", and "x5c" is absent from <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult①">attestationObjectResult</a></code>, then <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation④">self attestation</a> is being used and no further action is needed.</p>
+                <p>If the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid①">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data">attested credential data</a> is 16 zero bytes, <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult">attestationObjectResult</a>.fmt</code> is "packed", and "x5c" is absent from <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult①">attestationObjectResult</a></code>, then <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation④">self attestation</a> is being used and no further action is needed.</p>
                <li data-md>
                 <p>Otherwise</p>
                 <ol>
                  <li data-md>
-                  <p>Replace the <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid②">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">attested credential data</a> with 16 zero bytes.</p>
+                  <p>Replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid②">AAGUID</a> in the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①">attested credential data</a> with 16 zero bytes.</p>
                  <li data-md>
                   <p>Set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult②">attestationObjectResult</a>.fmt</code> to "none", and set the value of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult③">attestationObjectResult</a>.attStmt</code> to be an empty <a data-link-type="dfn" href="#cbor" id="ref-for-cbor③">CBOR</a> map. (See <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> and <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>).</p>
                 </ol>
               </ol>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect">indirect</a></code>
              <dd data-md>
-              <p>The client MAY replace the <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid③">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②">attestation statement</a> with a more privacy-friendly
+              <p>The client MAY replace the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid③">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a> with a more privacy-friendly
 and/or more easily verifiable version of the same data (for example, by employing an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca">Anonymization CA</a>).</p>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-direct" id="ref-for-dom-attestationconveyancepreference-direct">direct</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise①">enterprise</a></code>
              <dd data-md>
-              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦①">authenticator</a>'s <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid④">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑤">Relying Party</a>.</p>
+              <p>Convey the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦①">authenticator</a>'s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid④">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Party</a>.</p>
             </dl>
            <li data-md>
-            <p>Let <var>attestationObject</var> be a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor①">%ArrayBuffer%</a>, containing the
+            <p>Let <var>attestationObject</var> be a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑤">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor①">%ArrayBuffer%</a>, containing the
 bytes of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-attestationobjectresult" id="ref-for-credentialcreationdata-attestationobjectresult④">attestationObjectResult</a></code>’s value.</p>
            <li data-md>
-            <p>Let <var>id</var> be <code><var>attestationObject</var>.authData.<a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata">attestedCredentialData</a>.<a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid">credentialId</a></code>.</p>
+            <p>Let <var>id</var> be <code><var>attestationObject</var>.authData.<a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata">attestedCredentialData</a>.<a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid">credentialId</a></code>.</p>
            <li data-md>
-            <p>Let <var>pubKeyCred</var> be a new <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⓪">PublicKeyCredential</a></code> object associated with <var>global</var> whose fields are:</p>
+            <p>Let <var>pubKeyCred</var> be a new <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①②">PublicKeyCredential</a></code> object associated with <var>global</var> whose fields are:</p>
             <dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-identifier-slot" id="ref-for-dom-publickeycredential-identifier-slot②">[[identifier]]</a></code>
              <dd data-md>
@@ -2279,22 +2404,22 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
              <dd data-md>
               <p>A new <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse①">AuthenticatorAttestationResponse</a></code> object associated with <var>global</var> whose fields are:</p>
               <dl>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson">clientDataJSON</a></code>
+               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①">clientDataJSON</a></code>
                <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor②">%ArrayBuffer%</a>, containing the bytes of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-clientdatajsonresult" id="ref-for-credentialcreationdata-clientdatajsonresult">clientDataJSONResult</a></code>.</p>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject">attestationObject</a></code>
+                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑥">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor②">%ArrayBuffer%</a>, containing the bytes of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-clientdatajsonresult" id="ref-for-credentialcreationdata-clientdatajsonresult">clientDataJSONResult</a></code>.</p>
+               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject①">attestationObject</a></code>
                <dd data-md>
                 <p><var>attestationObject</var></p>
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-transports-slot" id="ref-for-dom-authenticatorattestationresponse-transports-slot">[[transports]]</a></code>
                <dd data-md>
-                <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
-                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑥">Relying Party</a> behavior may be suboptimal.</p>
+                <p>A sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①①">DOMString</a></code>s, in lexicographical order, that the <var>authenticator</var> is believed to support. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport">AuthenticatorTransport</a></code>, but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform①⑨">client platforms</a> MUST ignore unknown values.</p>
+                <p>If a user agent does not wish to divulge this information it MAY substitute an arbitrary sequence designed to preserve privacy. This sequence MUST still be valid, i.e. lexicographically sorted and free of duplicates. For example, it may use the empty sequence. Either way, in this case the user agent takes the risk that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Party</a> behavior may be suboptimal.</p>
                 <p>If the user agent does not have any transport information, it SHOULD set this field to the empty sequence.</p>
                 <p class="note" role="note"><span>Note:</span> How user agents discover transports supported by a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦②">authenticator</a> is outside the scope of this specification, but may include information from an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②">attestation certificate</a> (for example <a data-link-type="biblio" href="#biblio-fido-transports-ext">[FIDO-Transports-Ext]</a>), metadata communicated in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦③">authenticator</a> protocol such as CTAP2, or special-case knowledge about a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①①">platform authenticator</a>.</p>
               </dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot①">[[clientExtensionsResults]]</a></code>
              <dd data-md>
-              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer④">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor③">%ArrayBuffer%</a>, containing the bytes of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults">clientExtensionResults</a></code>.</p>
+              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑦">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor③">%ArrayBuffer%</a>, containing the bytes of <code><var>credentialCreationData</var>.<a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults">clientExtensionResults</a></code>.</p>
             </dl>
            <li data-md>
             <p>Return <var>pubKeyCred</var>.</p>
@@ -2314,14 +2439,17 @@ <h4 class="heading settled" data-level="5.1.3" id="sctn-createCredential"><span
    </div>
    <h4 class="heading settled" data-level="5.1.4" id="sctn-getAssertion"><span class="secno">5.1.4. </span><span class="content">Use an Existing Credential to Make an Assertion - PublicKeyCredential’s <code>[[Get]](options)</code> Method</span><a class="self-link" href="#sctn-getAssertion"></a></h4>
    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①②">WebAuthn Relying Parties</a> call <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①③">navigator.credentials.get({publicKey:..., ...})</a></code> to
-discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑦">Relying Party</a> script optionally specifies some criteria
-to indicate what <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source①">credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source②">credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
-decline the entire interaction even if a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source③">credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source④">credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑧">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑥">credential</a>.</p>
-   <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①④">get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credentials</a> that
-should be available without <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated">user mediation</a> (roughly, this specification’s <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①③">authorization gesture</a>), and if it does not find
+discover and use an existing <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑥">public key credential</a>, with the <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent⑨">user’s consent</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a> script optionally specifies some criteria
+to indicate what <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential sources</a> are acceptable to it. The <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⓪">client platform</a> locates <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential sources</a> matching the specified criteria, and guides the user to pick one that the script will be allowed to use. The user may choose to
+decline the entire interaction even if a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential source</a> is present, for example to maintain privacy. If the user picks a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential source</a>, the user agent then uses <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> to sign a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Party</a>-provided challenge and other collected data into an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion⑨">authentication assertion</a>, which is used as a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑥">credential</a>.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①④">navigator.credentials.get()</a></code> implementation <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-collectfromcredentialstore-slot" id="ref-for-dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]]()</a></code></code> to collect any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑦">credentials</a> that
+should be available without <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated②">user mediation</a> (roughly, this specification’s <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①③">authorization gesture</a>), and if it does not find
 exactly one of those, it then calls <code>PublicKeyCredential.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot②">[[DiscoverFromExternalSource]]()</a></code></code> to have
-the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#credential-source" id="ref-for-credential-source⑤">credential source</a>.</p>
+the user select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">public key credential source</a>.</p>
    <p>Since this specification requires an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①④">authorization gesture</a> to create any <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①">assertions</a>, the <code>PublicKeyCredential.<dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-collectfromcredentialstore-slot"><code>[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</code></dfn></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots⑨">internal method</a> inherits the default behavior of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#collectfromcredentialstore-origin-options-sameoriginwithancestors" id="ref-for-collectfromcredentialstore-origin-options-sameoriginwithancestors①">Credential.[[CollectFromCredentialStore]]()</a></code>, of returning an empty set.</p>
+   <p>In general, the user agent SHOULD show some UI to the user to guide them in selecting and authorizing an authenticator with which
+to complete the operation. By setting <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation①">mediation</a></code></code> to <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional④">conditional</a></code>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Parties</a> can indicate that a prominent modal UI should <i>not</i> be shown <i>unless</i> credentials are discovered. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a> script SHOULD first check that <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-isconditionalmediationavailable" id="ref-for-dom-publickeycredential-isconditionalmediationavailable①">isConditionalMediationAvailable()</a></code> returns <code>true</code> in order to avoid
+the possibility of causing a user-visible error to be returned if the user agent does not support <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑤">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated③">user mediation</a>.</p>
    <p>This <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑤">navigator.credentials.get()</a></code> operation can be aborted by leveraging the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller①">AbortController</a></code>;
 see <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> for detailed instructions.</p>
    <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external-source"><span class="secno">5.1.4.1. </span><span class="content">PublicKeyCredential’s <code><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-discoverfromexternalsource-slot"><code>[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</code></dfn></code> Method</span><a class="self-link" href="#sctn-discover-from-external-source"></a></h5>
@@ -2341,7 +2469,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
       <p class="note" role="note"><span>Note:</span> Invocation of this <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①①">internal method</a> indicates that it was allowed by <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy">permissions policy</a>, which is evaluated at the <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> level.
 See <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
     </dl>
-    <p class="note" role="note"><span>Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise②">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code>.</p>
+    <p class="note" role="note"><span>Note:</span> <strong>This algorithm is synchronous:</strong> the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise③">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑦">navigator.credentials.get()</a></code>.</p>
     <p class="note" role="note"><span>Note:</span> All <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①">BufferSource</a></code> objects used in this algorithm must be snapshotted when the algorithm begins, to
 avoid potential synchronization issues. The algorithm implementations should <a data-link-type="dfn" href="https://heycam.github.io/webidl#dfn-get-buffer-source-reference" id="ref-for-dfn-get-buffer-source-reference①">get a copy of the bytes held
 by the buffer source</a> and use that copy for relevant portions of the algorithm.</p>
@@ -2352,31 +2480,46 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <li data-md>
       <p>Let <var>options</var> be the value of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey③">publicKey</a></code></code>.</p>
      <li data-md>
-      <p>If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout">timeout</a></code> member of <var>options</var> is present, check if its value lies
-within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②⓪">client</a> and if not, correct it to the closest value lying within that range.
-Set a timer <var>lifetimeTimer</var> to this adjusted value. If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code> member of <var>options</var> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②①">client</a>-specific default.</p>
-      <p>Recommended ranges and defaults for the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout②">timeout</a></code> member of <var>options</var> are as follows.
+      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation②">mediation</a></code></code> is present with the value <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑥">conditional</a></code>:</p>
+      <ol>
+       <li data-md>
+        <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑤">allowCredentials</a></code></code> is not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①">empty</a>,
+return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑨">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>", and terminate this algorithm.</p>
+       <li data-md>
+        <p>Set a timer <var>lifetimeTimer</var> to a value of infinity.</p>
+        <p class="note" role="note"><span>Note:</span> <var>lifetimeTimer</var> is set to a value of infinity so that the user has the entire lifetime of
+the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document" id="ref-for-concept-document">Document</a> to interact with any <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element">input</a></code> form control tagged with a <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens">autofill detail token</a>. For example, upon the user clicking in such an input field, the user agent can render a list of discovered credentials for the user to select from, and perhaps also give the user the option to "try another way".</p>
+      </ol>
+     <li data-md>
+      <p>Else:</p>
+      <ol>
+       <li data-md>
+        <p>If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout">timeout</a></code> member of <var>options</var> is present, check if its value lies
+within a reasonable range as defined by the <a data-link-type="dfn" href="#client" id="ref-for-client②①">client</a> and if not, correct it to the closest value lying within that range.
+Set a timer <var>lifetimeTimer</var> to this adjusted value. If the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout①">timeout</a></code> member of <var>options</var> is not present, then set <var>lifetimeTimer</var> to a <a data-link-type="dfn" href="#client" id="ref-for-client②②">client</a>-specific default.</p>
+        <p>Recommended ranges and defaults for the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout②">timeout</a></code> member of <var>options</var> are as follows.
       If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification">userVerification</a></code></code></p>
-      <dl class="switch">
-       <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged②">discouraged</a></code>
-       <dd data-md>
-        <p>Recommended range: 30000 milliseconds to 180000 milliseconds.</p>
-       <dd data-md>
-        <p>Recommended default value: 120000 milliseconds (2 minutes).</p>
-       <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required③">required</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred②">preferred</a></code>
-       <dd data-md>
-        <p>Recommended range: 30000 milliseconds to 600000 milliseconds.</p>
-       <dd data-md>
-        <p>Recommended default value: 300000 milliseconds (5 minutes).</p>
-      </dl>
-      <p class="note" role="note"><span>Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
+        <dl class="switch">
+         <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged②">discouraged</a></code>
+         <dd data-md>
+          <p>Recommended range: 30000 milliseconds to 180000 milliseconds.</p>
+         <dd data-md>
+          <p>Recommended default value: 120000 milliseconds (2 minutes).</p>
+         <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required③">required</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred②">preferred</a></code>
+         <dd data-md>
+          <p>Recommended range: 30000 milliseconds to 600000 milliseconds.</p>
+         <dd data-md>
+          <p>Recommended default value: 300000 milliseconds (5 minutes).</p>
+        </dl>
+        <p class="note" role="note"><span>Note:</span> The user agent should take cognitive guidelines into considerations regarding timeout for users with special needs.</p>
+      </ol>
      <li data-md>
       <p>Let <var>callerOrigin</var> be <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin" id="ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin">origin</a></code>. If <var>callerOrigin</var> is
-an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque②">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException⑨">DOMException</a></code>.</p>
+an <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-opaque" id="ref-for-concept-origin-opaque②">opaque origin</a>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror④">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⓪">DOMException</a></code>.</p>
      <li data-md>
       <p>Let <var>effectiveDomain</var> be the <var>callerOrigin</var>’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑧">effective domain</a>.
 If <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain⑨">effective domain</a> is not a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#valid-domain" id="ref-for-valid-domain①">valid domain</a>, then throw a
-"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⓪">DOMException</a></code>.</p>
+"<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror②">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>.</p>
       <p class="note" role="note"><span>Note:</span> An <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①⓪">effective domain</a> may resolve to a <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host③">host</a>, which can be represented in various manners,
     such as <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain③">domain</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv4" id="ref-for-concept-ipv4①">ipv4 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-ipv6" id="ref-for-concept-ipv6①">ipv6 address</a>, <a data-link-type="dfn" href="https://url.spec.whatwg.org/#opaque-host" id="ref-for-opaque-host①">opaque host</a>, or <a data-link-type="dfn" href="https://url.spec.whatwg.org/#empty-host" id="ref-for-empty-host①">empty host</a>.
     Only the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-domain" id="ref-for-concept-domain④">domain</a> format of <a data-link-type="dfn" href="https://url.spec.whatwg.org/#concept-url-host" id="ref-for-concept-url-host④">host</a> is allowed here. This is for simplification and also is
@@ -2388,7 +2531,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
       <ol>
        <li data-md>
         <p>If <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid①">rpId</a></code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to" id="ref-for-is-a-registrable-domain-suffix-of-or-is-equal-to④">is not a registrable domain suffix of and is not
-equal to</a> <var>effectiveDomain</var>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①①">DOMException</a></code>.</p>
+equal to</a> <var>effectiveDomain</var>, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror③">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
        <li data-md>
         <p>Set <var>rpId</var> to <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid②">rpId</a></code>.</p>
         <p class="note" role="note"><span>Note:</span> <var>rpId</var> represents the caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id①⑨">RP ID</a>. The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⓪">RP ID</a> defaults to being the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑤">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①①">effective domain</a> unless the caller has explicitly set <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid③">rpId</a></code> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑧">get()</a></code>.</p>
@@ -2407,7 +2550,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
        <li data-md>
         <p>Let <var>authenticatorExtensionInput</var> be the (<a data-link-type="dfn" href="#cbor" id="ref-for-cbor④">CBOR</a>) result of running <var>extensionId</var>’s <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing③">client extension processing</a> algorithm on <var>clientExtensionInput</var>. If the algorithm returned an error, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①②">continue</a>.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set③">Set</a> <var>authenticatorExtensions</var>[<var>extensionId</var>] to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding③">base64url encoding</a> of <var>authenticatorExtensionInput</var>.</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set③">Set</a> <var>authenticatorExtensions</var>[<var>extensionId</var>] to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑤">base64url encoding</a> of <var>authenticatorExtensionInput</var>.</p>
       </ol>
      <li data-md>
       <p>Let <var>collectedClientData</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①">CollectedClientData</a></code> instance whose fields are:</p>
@@ -2417,7 +2560,7 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p>The string "webauthn.get".</p>
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge①">challenge</a></code>
        <dd data-md>
-        <p>The <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding④">base64url encoding</a> of <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge">challenge</a></code></p>
+        <p>The <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑥">base64url encoding</a> of <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge">challenge</a></code></p>
        <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①">origin</a></code>
        <dd data-md>
         <p>The <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#ascii-serialisation-of-an-origin" id="ref-for-ascii-serialisation-of-an-origin①">serialization of</a> <var>callerOrigin</var>.</p>
@@ -2437,9 +2580,11 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
      <li data-md>
       <p>Let <var>savedCredentialIds</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑤">map</a>.</p>
      <li data-md>
-      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item②">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
+      <p>Let <var>authenticators</var> represent a value which at any given instant is a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set③">set</a> of <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②②">client platform</a>-specific handles, where each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">item</a> identifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦④">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②③">client platform</a> at that instant.</p>
       <p class="note" role="note"><span>Note:</span> What qualifies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑤">authenticator</a> as "available" is intentionally unspecified; this is meant to represent how <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑥">authenticators</a> can be <a href="https://en.wikipedia.org/w/index.php?title=Hot_plug">hot-plugged</a> into (e.g., via USB)
-or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②②">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a>.</p>
+or discovered (e.g., via NFC or Bluetooth) by the <a data-link-type="dfn" href="#client" id="ref-for-client②③">client</a> by various mechanisms, or permanently built into the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a>.</p>
+     <li data-md>
+      <p>Let <var>silentlyDiscoveredCredentials</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry">entries</a> are of the form: <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata">DiscoverableCredentialMetadata</a> → <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a>.</p>
      <li data-md>
       <p>Start <var>lifetimeTimer</var>.</p>
      <li data-md>
@@ -2451,89 +2596,73 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⓪">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑥">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①①">remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
        <dt data-md>If the user exercises a user agent user-interface option to cancel the process,
        <dd data-md>
-        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①①">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑦">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑤">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①②">DOMException</a></code>.</p>
+        <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①①">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑦">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①②">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑤">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code>.</p>
        <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal②">signal</a></code></code> is present and <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted③">aborted</a>,
        <dd data-md>
         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①②">For each</a> <var>authenticator</var> in <var>issuedRequests</var> invoke the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel⑧">authenticatorCancel</a> operation on <var>authenticator</var> and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①③">remove</a> <var>authenticator</var> from <var>issuedRequests</var>. Then
 throw the <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal" id="ref-for-dom-credentialrequestoptions-signal③">signal</a></code></code>’s <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-abort-reason" id="ref-for-abortsignal-abort-reason③">abort reason</a>.</p>
-       <dt data-md>If <var>issuedRequests</var> is empty, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑤">allowCredentials</a></code></code> is not empty, and no <var>authenticator</var> will become available for any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑧">public key credentials</a> therein,
-       <dd data-md>
-        <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑥">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①③">DOMException</a></code>.</p>
-        <p class="note" role="note"><span>Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports④">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item③">items</a> of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑥">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item④">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
-       <dt data-md>If an <var>authenticator</var> becomes available on this <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①④">client device</a>,
+       <dt id="GetAssn-ConditionalMediation-Interact-FormControl"><a class="self-link" href="#GetAssn-ConditionalMediation-Interact-FormControl"></a> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation③">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑦">conditional</a></code> and the user interacts with an <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/input.html#the-input-element" id="ref-for-the-input-element①">input</a></code> or <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element" id="ref-for-the-textarea-element">textarea</a></code> form control with an <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete" id="ref-for-attr-fe-autocomplete">autocomplete</a></code> attribute whose value
+      contains a <code>"webauthn"</code> <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens" id="ref-for-autofill-detail-tokens①">autofill detail token</a>, 
        <dd data-md>
-        <p class="note" role="note"><span>Note:</span> This includes the case where an <var>authenticator</var> was available upon <var>lifetimeTimer</var> initiation.</p>
         <ol>
          <li data-md>
-          <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification①">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code> and the <var>authenticator</var> is not capable of performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑤">user verification</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①③">continue</a>.</p>
-         <li data-md>
-          <p>Let <var>userVerification</var> be the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</dfn>, a Boolean value, as
-follows. If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification②">userVerification</a></code></code></p>
-          <dl class="switch">
-           <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤">required</a></code>
-           <dd data-md>
-            <p>Let <var>userVerification</var> be <code>true</code>.</p>
-           <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred③">preferred</a></code>
-           <dd data-md>
-            <p>If the <var>authenticator</var></p>
-            <dl class="switch">
-             <dt data-md>is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑥">user verification</a>
-             <dd data-md>
-              <p>Let <var>userVerification</var> be <code>true</code>.</p>
-             <dt data-md>is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑦">user verification</a>
-             <dd data-md>
-              <p>Let <var>userVerification</var> be <code>false</code>.</p>
-            </dl>
-           <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged③">discouraged</a></code>
-           <dd data-md>
-            <p>Let <var>userVerification</var> be <code>false</code>.</p>
-          </dl>
-         <li data-md>
-          <p><span id="allowCredentialDescriptorListCreation"></span> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑦">allowCredentials</a></code></code></p>
-          <dl class="switch">
-           <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty④">is not empty</a>
-           <dd data-md>
+          <p>If <var>silentlyDiscoveredCredentials</var> is not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty②">empty</a>:</p>
+          <ol>
+           <li data-md>
+            <p>Prompt the user to optionally select a <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata①">DiscoverableCredentialMetadata</a> (<var>credentialMetadata</var>) from <var>silentlyDiscoveredCredentials</var>.</p>
+            <p class="note" role="note"><span>Note:</span> The prompt shown SHOULD include values from <var>credentialMetadata</var>’s <a data-link-type="dfn" href="#discoverablecredentialmetadata-otherui" id="ref-for-discoverablecredentialmetadata-otherui">otherUI</a> such as <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①">displayName</a></code>.</p>
+           <li data-md>
+            <p>If the user selects a <var>credentialMetadata</var>,</p>
             <ol>
              <li data-md>
-              <p>Let <var>allowCredentialDescriptorList</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list②">list</a>.</p>
-             <li data-md>
-              <p>Execute a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific procedure to determine which, if any, <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑨">public key credentials</a> described by <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">allowCredentials</a></code></code> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⓪">bound</a> to this <var>authenticator</var>, by matching with <var>rpId</var>, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id">id</a></code></code>,
-and <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⓪">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type">type</a></code></code>.
-Set <var>allowCredentialDescriptorList</var> to this filtered list.</p>
+              <p>Let <var>publicKeyOptions</var> be a temporary copy of <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code>.</p>
              <li data-md>
-              <p>If <var>allowCredentialDescriptorList</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑤">is empty</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①④">continue</a>.</p>
+              <p>Let <var>authenticator</var> be the value of <var>silentlyDiscoveredCredentials</var>[<var>credentialMetadata</var>].</p>
              <li data-md>
-              <p>Let <var>distinctTransports</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set④">ordered set</a>.</p>
+              <p>Set <code><var>publicKeyOptions</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑥">allowCredentials</a></code></code> to be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list②">list</a> containing a
+single <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①">PublicKeyCredentialDescriptor</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item④">item</a> whose <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①">id</a></code>'s value is set to <var>credentialMetadata</var>’s <a data-link-type="dfn" href="#discoverablecredentialmetadata-id" id="ref-for-discoverablecredentialmetadata-id">id</a>'s value and whose<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id②">id</a></code> value is set to <var>credentialMetadata</var>’s <a data-link-type="dfn" href="#discoverablecredentialmetadata-type" id="ref-for-discoverablecredentialmetadata-type">type</a>.</p>
              <li data-md>
-              <p>If <var>allowCredentialDescriptorList</var> has exactly one value, set <code><var>savedCredentialIds</var>[<var>authenticator</var>]</code> to <code><var>allowCredentialDescriptorList</var>[0].id</code>’s
-value (see <a href="#authenticatorGetAssertion-return-values">here</a> in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> for more information).</p>
+              <p>Execute the <a data-link-type="dfn" href="#publickeycredential-issuing-a-credential-request-to-an-authenticator" id="ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator">issuing a credential request to an authenticator</a> algorithm with <var>authenticator</var>, <var>savedCredentialIds</var>, <var>publicKeyOptions</var>, <var>rpId</var>, <var>clientDataHash</var>, and <var>authenticatorExtensions</var>.</p>
+              <p>If this returns <code>false</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①③">continue</a>.</p>
              <li data-md>
-              <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①③">For each</a> credential descriptor <var>C</var> in <var>allowCredentialDescriptorList</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append①">append</a> each value, if any, of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> to <var>distinctTransports</var>.</p>
-              <p class="note" role="note"><span>Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑦">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑦">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
+              <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append①">Append</a> <var>authenticator</var> to <var>issuedRequests</var>.</p>
+            </ol>
+          </ol>
+        </ol>
+       <dt data-md>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation④">mediation</a></code></code> is not <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑧">conditional</a></code>, <var>issuedRequests</var> is empty, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑦">allowCredentials</a></code></code> is not empty,
+and no <var>authenticator</var> will become available for any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑧">public key credentials</a> therein,
+       <dd data-md>
+        <p>Indicate to the user that no eligible credential could be found. When the user acknowledges the dialog, throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑥">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>.</p>
+        <p class="note" role="note"><span>Note:</span> One way a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②④">client platform</a> can determine that no <var>authenticator</var> will become available is by examining the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑤">transports</a></code></code> members of the present <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor②">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑤">items</a> of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">allowCredentials</a></code></code>, if any. For example, if all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> list only <code><code class="idl"><a data-link-type="idl" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal">internal</a></code></code>, but all <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①②">platform</a> <var>authenticator</var>s have been tried, then there is no possibility of satisfying the request. Alternatively, all <code><code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">items</a> may list <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑥">transports</a></code></code> that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑤">client platform</a> does not support.</p>
+       <dt data-md>If an <var>authenticator</var> becomes available on this <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①④">client device</a>,
+       <dd data-md>
+        <p class="note" role="note"><span>Note:</span> This includes the case where an <var>authenticator</var> was available upon <var>lifetimeTimer</var> initiation.</p>
+        <ol>
+         <li data-md>
+          <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation⑤">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional⑨">conditional</a></code> and the <var>authenticator</var> supports the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery">silentCredentialDiscovery</a> operation:</p>
+          <ol>
+           <li data-md>
+            <p>Let <var>collectedDiscoveredCredentialMetadata</var> be the result of invoking the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery①">silentCredentialDiscovery</a> operation on <var>authenticator</var> with <var>rpId</var> as parameter.</p>
+           <li data-md>
+            <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①③">For each</a> <var>credentialMetadata</var> of <var>collectedDiscoveredCredentialMetadata</var>:</p>
+            <ol>
              <li data-md>
-              <p>If <var>distinctTransports</var></p>
-              <dl class="switch">
-               <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑥">is not empty</a>
-               <dd data-md>
-                <p>The client selects one <var>transport</var> value from <var>distinctTransports</var>, possibly incorporating local
-configuration knowledge of the appropriate transport to use with <var>authenticator</var> in making its
-selection.</p>
-                <p>Then, using <var>transport</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion③">authenticatorGetAssertion</a> operation on <var>authenticator</var>, with <var>rpId</var>, <var>clientDataHash</var>, <var>allowCredentialDescriptorList</var>, <var>userVerification</var>, and <var>authenticatorExtensions</var> as parameters.</p>
-               <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑦">is empty</a>
-               <dd data-md>
-                <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>,
-invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion④">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>allowCredentialDescriptorList</var>, <var>userVerification</var>, and <var>authenticatorExtensions</var> as parameters.</p>
-              </dl>
+              <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set④">Set</a> <var>silentlyDiscoveredCredentials</var>[<var>credentialMetadata</var>] to <var>authenticator</var>.</p>
+              <p class="note" role="note"><span>Note:</span> A request will be issued to this authenticator upon user selection of a credential via
+interaction with a particular UI context
+(see <a href="#GetAssn-ConditionalMediation-Interact-FormControl">here</a> for details).</p>
             </ol>
-           <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑧">is empty</a>
-           <dd data-md>
-            <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑤">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>userVerification</var> and <var>authenticatorExtensions</var> as parameters.</p>
-            <p class="note" role="note"><span>Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑧⑨">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
-    authenticator is being asked to exercise any credential it may possess that is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑨">scoped</a> to
-    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⓪">Relying Party</a>, as identified by <var>rpId</var>.</p>
-          </dl>
+          </ol>
          <li data-md>
-          <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append②">Append</a> <var>authenticator</var> to <var>issuedRequests</var>.</p>
+          <p>Else:</p>
+          <ol>
+           <li data-md>
+            <p>Execute the <a data-link-type="dfn" href="#publickeycredential-issuing-a-credential-request-to-an-authenticator" id="ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator①">issuing a credential request to an authenticator</a> algorithm with <var>authenticator</var>, <var>savedCredentialIds</var>, <var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey⑤">publicKey</a></code>, <var>rpId</var>, <var>clientDataHash</var>, and <var>authenticatorExtensions</var>.</p>
+            <p>If this returns <code>false</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①④">continue</a>.</p>
+            <p class="note" role="note"><span>Note:</span> This branch is taken if <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation" id="ref-for-dom-credentialrequestoptions-mediation⑥">mediation</a></code></code> is <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①⓪">conditional</a></code> and the <var>authenticator</var> does not support the <a data-link-type="dfn" href="#silentcredentialdiscovery" id="ref-for-silentcredentialdiscovery②">silentCredentialDiscovery</a> operation to allow use of such authenticators during a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①①">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated④">user mediation</a> request.</p>
+           <li data-md>
+            <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append②">Append</a> <var>authenticator</var> to <var>issuedRequests</var>.</p>
+          </ol>
         </ol>
        <dt data-md>If an <var>authenticator</var> ceases to be available on this <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑤">client device</a>,
        <dd data-md>
@@ -2558,18 +2687,18 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
          <li data-md>
           <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove①⑧">Remove</a> <var>authenticator</var> from <var>issuedRequests</var>.</p>
          <li data-md>
-          <p><span id="assertionCreationDataCreation"></span> Let <var>assertionCreationData</var> be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct②">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item③">items</a> are:</p>
+          <p><span id="assertionCreationDataCreation"></span> Let <var>assertionCreationData</var> be a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct③">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item⑨">items</a> are:</p>
           <dl>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-credentialidresult">credentialIdResult</dfn></code>
            <dd data-md>
             <p>If <code><var>savedCredentialIds</var>[<var>authenticator</var>]</code> exists, set the value of <a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult">credentialIdResult</a> to be
-the bytes of <code><var>savedCredentialIds</var>[<var>authenticator</var>]</code>. Otherwise, set the value of <a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult①">credentialIdResult</a> to be the bytes of the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id①⑨">credential ID</a> returned from the successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑥">authenticatorGetAssertion</a> operation, as defined in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>.</p>
+the bytes of <code><var>savedCredentialIds</var>[<var>authenticator</var>]</code>. Otherwise, set the value of <a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult①">credentialIdResult</a> to be the bytes of the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⓪">credential ID</a> returned from the successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion③">authenticatorGetAssertion</a> operation, as defined in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-clientdatajsonresult">clientDataJSONResult</dfn></code>
            <dd data-md>
             <p>whose value is the bytes of <var>clientDataJSON</var>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-authenticatordataresult">authenticatorDataResult</dfn></code>
            <dd data-md>
-            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticator</a>.</p>
+            <p>whose value is the bytes of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑦⑨">authenticator</a>.</p>
            <dt data-md><code><dfn class="dfn-paneled" data-dfn-for="assertionCreationData" data-dfn-type="dfn" data-noexport id="assertioncreationdata-signatureresult">signatureResult</dfn></code>
            <dd data-md>
             <p>whose value is the bytes of the signature value returned by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⓪">authenticator</a>.</p>
@@ -2585,11 +2714,11 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
           <p>Let <var>constructAssertionAlg</var> be an algorithm that takes a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-global" id="ref-for-concept-settings-object-global①">global object</a> <var>global</var>, and whose steps are:</p>
           <ol>
            <li data-md>
-            <p>Let <var>pubKeyCred</var> be a new <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①①">PublicKeyCredential</a></code> object associated with <var>global</var> whose fields are:</p>
+            <p>Let <var>pubKeyCred</var> be a new <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①③">PublicKeyCredential</a></code> object associated with <var>global</var> whose fields are:</p>
             <dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-identifier-slot" id="ref-for-dom-publickeycredential-identifier-slot③">[[identifier]]</a></code>
              <dd data-md>
-              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑤">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor④">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult②">credentialIdResult</a></code>.</p>
+              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑧">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor④">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-credentialidresult" id="ref-for-assertioncreationdata-credentialidresult②">credentialIdResult</a></code>.</p>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment③">authenticatorAttachment</a></code>
              <dd data-md>
               <p>The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment②">AuthenticatorAttachment</a></code> value matching the current <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality④">authenticator attachment modality</a> of <var>authenticator</var>.</p>
@@ -2597,23 +2726,23 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
              <dd data-md>
               <p>A new <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse②">AuthenticatorAssertionResponse</a></code> object associated with <var>global</var> whose fields are:</p>
               <dl>
-               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①">clientDataJSON</a></code>
+               <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson②">clientDataJSON</a></code>
                <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑥">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑤">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientdatajsonresult" id="ref-for-assertioncreationdata-clientdatajsonresult">clientDataJSONResult</a></code>.</p>
+                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑨">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑤">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientdatajsonresult" id="ref-for-assertioncreationdata-clientdatajsonresult">clientDataJSONResult</a></code>.</p>
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata">authenticatorData</a></code>
                <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑦">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑥">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-authenticatordataresult" id="ref-for-assertioncreationdata-authenticatordataresult">authenticatorDataResult</a></code>.</p>
+                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⓪">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑥">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-authenticatordataresult" id="ref-for-assertioncreationdata-authenticatordataresult">authenticatorDataResult</a></code>.</p>
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature">signature</a></code>
                <dd data-md>
-                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑧">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑦">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-signatureresult" id="ref-for-assertioncreationdata-signatureresult">signatureResult</a></code>.</p>
+                <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①①">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑦">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-signatureresult" id="ref-for-assertioncreationdata-signatureresult">signatureResult</a></code>.</p>
                <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle②">userHandle</a></code>
                <dd data-md>
                 <p>If <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult②">userHandleResult</a></code> is null, set this
-field to null. Otherwise, set this field to a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer⑨">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑧">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult③">userHandleResult</a></code>.</p>
+field to null. Otherwise, set this field to a new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①②">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑧">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult③">userHandleResult</a></code>.</p>
               </dl>
              <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-clientextensionsresults-slot" id="ref-for-dom-publickeycredential-clientextensionsresults-slot②">[[clientExtensionsResults]]</a></code>
              <dd data-md>
-              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⓪">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑨">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientextensionresults" id="ref-for-assertioncreationdata-clientextensionresults">clientExtensionResults</a></code>.</p>
+              <p>A new <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①③">ArrayBuffer</a></code>, created using <var>global</var>’s <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-arraybuffer-constructor" id="ref-for-sec-arraybuffer-constructor⑨">%ArrayBuffer%</a>, containing the bytes of <code><var>assertionCreationData</var>.<a data-link-type="dfn" href="#assertioncreationdata-clientextensionresults" id="ref-for-assertioncreationdata-clientextensionresults">clientExtensionResults</a></code>.</p>
             </dl>
            <li data-md>
             <p>Return <var>pubKeyCred</var>.</p>
@@ -2626,22 +2755,121 @@ <h5 class="heading settled" data-level="5.1.4.1" id="sctn-discover-from-external
         </ol>
       </dl>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑦">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①④">DOMException</a></code>. In order to prevent information leak that could identify the
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑦">NotAllowedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>. In order to prevent information leak that could identify the
 user without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⓪">consent</a>, this step MUST NOT be executed before <var>lifetimeTimer</var> has expired. See <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a> for details.</p>
     </ol>
-    <p>During the above process, the user agent SHOULD show some UI to the user to guide them in the process of selecting and
-authorizing an authenticator with which to complete the operation.</p>
    </div>
+   <h5 class="heading settled" data-level="5.1.4.2" id="sctn-issuing-cred-request-to-authenticator"><span class="secno">5.1.4.2. </span><span class="content"><dfn class="dfn-paneled algorithm" data-algorithm="Issuing a credential request to an authenticator" data-dfn-for="PublicKeyCredential" data-dfn-type="dfn" data-noexport id="publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</dfn></span><a class="self-link" href="#sctn-issuing-cred-request-to-authenticator"></a></h5>
+   <p>This sub-algorithm of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]]()</a></code> encompasses the specific UI context-independent
+steps necessary for requesting a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credential</a> from a given <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">authenticator</a>, using given <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code>.
+It is called by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">[[DiscoverFromExternalSource]]()</a></code> from various points depending on which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑤">user mediation</a> the present <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑨">authentication ceremony</a> is subject to (e.g.: <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①②">conditional</a></code> mediation).</p>
+   <p>This algorithm accepts the following arguments:</p>
+   <dl>
+    <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-authenticator"><code>authenticator</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-authenticator"></a></dfn>
+    <dd data-md>
+     <p>A <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑥">client platform</a>-specific handle identifying an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a> presently available on this <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"><code>savedCredentialIds</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-savedcredentialids"></a></dfn>
+    <dd data-md>
+     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> containing <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a> → <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a>. This argument will be modified in this algorithm.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-options"><code>options</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-options"></a></dfn>
+    <dd data-md>
+     <p>This argument is a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions③">PublicKeyCredentialRequestOptions</a></code> object specifying the desired attributes of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential②⑨">public key credential</a> to discover.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-rpid"><code>rpId</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-rpid"></a></dfn>
+    <dd data-md>
+     <p>The request <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②①">RP ID</a>.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-clientdatahash"><code>clientDataHash</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-clientdatahash"></a></dfn>
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②">hash of the serialized client data</a> represented by <var>clientDataJSON</var>.</p>
+    <dt data-md><dfn class="idl-code" data-dfn-for="Issuing a credential request to an authenticator" data-dfn-type="argument" data-export id="dom-issuing-a-credential-request-to-an-authenticator-authenticatorextensions"><code>authenticatorExtensions</code><a class="self-link" href="#dom-issuing-a-credential-request-to-an-authenticator-authenticatorextensions"></a></dfn>
+    <dd data-md>
+     <p>A <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑧">map</a> containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier③">extension identifiers</a> to the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑦">base64url encoding</a> of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑤">client extension processing</a> output for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension②">authenticator extensions</a>.</p>
+   </dl>
+   <p>This algorithm returns <code>false</code> if the <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a> determines that the <var>authenticator</var> is not capable of handling the request, or <code>true</code> if
+the request was issued successfully.</p>
+   <p>The steps for <a data-link-type="dfn" href="#publickeycredential-issuing-a-credential-request-to-an-authenticator" id="ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator②">issuing a credential request to an authenticator</a> are as follows:</p>
+   <ol>
+    <li data-md>
+     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification①">userVerification</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required④">required</a></code> and the <var>authenticator</var> is not capable of performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑤">user verification</a>,
+return <code>false</code>.</p>
+    <li data-md>
+     <p>Let <var>userVerification</var> be the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</dfn>, a Boolean value, as
+follows. If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification②">userVerification</a></code></code></p>
+     <dl class="switch">
+      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑤">required</a></code>
+      <dd data-md>
+       <p>Let <var>userVerification</var> be <code>true</code>.</p>
+      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred③">preferred</a></code>
+      <dd data-md>
+       <p>If the <var>authenticator</var></p>
+       <dl class="switch">
+        <dt data-md>is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑥">user verification</a>
+        <dd data-md>
+         <p>Let <var>userVerification</var> be <code>true</code>.</p>
+        <dt data-md>is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑦">user verification</a>
+        <dd data-md>
+         <p>Let <var>userVerification</var> be <code>false</code>.</p>
+       </dl>
+      <dt data-md>is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged③">discouraged</a></code>
+      <dd data-md>
+       <p>Let <var>userVerification</var> be <code>false</code>.</p>
+     </dl>
+    <li data-md>
+     <p><span id="allowCredentialDescriptorListCreation"></span> If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">allowCredentials</a></code></code></p>
+     <dl class="switch">
+      <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty④">is not empty</a>
+      <dd data-md>
+       <ol>
+        <li data-md>
+         <p>Let <var>allowCredentialDescriptorList</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list③">list</a>.</p>
+        <li data-md>
+         <p>Execute a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑧">client platform</a>-specific procedure to determine which, if any, <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⓪">public key credentials</a> described by <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⓪">allowCredentials</a></code></code> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⓪">bound</a> to this <var>authenticator</var>, by matching with <var>rpId</var>, <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①①">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id③">id</a></code></code>,
+and <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①②">allowCredentials</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①">type</a></code></code>.
+Set <var>allowCredentialDescriptorList</var> to this filtered list.</p>
+        <li data-md>
+         <p>If <var>allowCredentialDescriptorList</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑤">is empty</a>, return <code>false</code>.</p>
+        <li data-md>
+         <p>Let <var>distinctTransports</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set④">ordered set</a>.</p>
+        <li data-md>
+         <p>If <var>allowCredentialDescriptorList</var> has exactly one value, set <code><var>savedCredentialIds</var>[<var>authenticator</var>]</code> to <code><var>allowCredentialDescriptorList</var>[0].id</code>’s
+value (see <a href="#authenticatorGetAssertion-return-values">here</a> in <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a> for more information).</p>
+        <li data-md>
+         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑥">For each</a> credential descriptor <var>C</var> in <var>allowCredentialDescriptorList</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append③">append</a> each value, if any, of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑦">transports</a></code></code> to <var>distinctTransports</var>.</p>
+         <p class="note" role="note"><span>Note:</span> This will aggregate only distinct values of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> (for this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a>) in <var>distinctTransports</var> due to the properties of <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑤">ordered sets</a>.</p>
+        <li data-md>
+         <p>If <var>distinctTransports</var></p>
+         <dl class="switch">
+          <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑥">is not empty</a>
+          <dd data-md>
+           <p>The client selects one <var>transport</var> value from <var>distinctTransports</var>, possibly incorporating local
+configuration knowledge of the appropriate transport to use with <var>authenticator</var> in making its
+selection.</p>
+           <p>Then, using <var>transport</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion④">authenticatorGetAssertion</a> operation on <var>authenticator</var>, with <var>rpId</var>, <var>clientDataHash</var>, <var>allowCredentialDescriptorList</var>, <var>userVerification</var>, and <var>authenticatorExtensions</var> as parameters.</p>
+          <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑦">is empty</a>
+          <dd data-md>
+           <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>,
+invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑤">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>allowCredentialDescriptorList</var>, <var>userVerification</var>, and <var>authenticatorExtensions</var> as parameters.</p>
+         </dl>
+       </ol>
+      <dt data-md><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑧">is empty</a>
+      <dd data-md>
+       <p>Using local configuration knowledge of the appropriate transport to use with <var>authenticator</var>, invoke the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑥">authenticatorGetAssertion</a> operation on <var>authenticator</var> with <var>rpId</var>, <var>clientDataHash</var>, <var>userVerification</var> and <var>authenticatorExtensions</var> as parameters.</p>
+       <p class="note" role="note"><span>Note:</span> In this case, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> did not supply a list of acceptable credential descriptors. Thus, the
+    authenticator is being asked to exercise any credential it may possess that is <a data-link-type="dfn" href="#scope" id="ref-for-scope⑨">scoped</a> to
+    the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Party</a>, as identified by <var>rpId</var>.</p>
+     </dl>
+    <li data-md>
+     <p>Return <code>true</code>.</p>
+   </ol>
    <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span class="secno">5.1.5. </span><span class="content">Store an Existing Credential - PublicKeyCredential’s <code>[[Store]](credential, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-storeCredential"></a></h4>
    <div data-link-for-hint="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)">
     <p>The <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export id="dom-publickeycredential-store-slot"><code>[[Store]](credential, sameOriginWithAncestors)</code><a class="self-link" href="#dom-publickeycredential-store-slot"></a></dfn> method is not supported
-for Web Authentication’s <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①②">PublicKeyCredential</a></code> type, so it always throws an error.</p>
-    <p class="note" role="note"><span>Note:</span> This algorithm is synchronous; the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise③">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store" id="ref-for-dom-credentialscontainer-store">navigator.credentials.store()</a></code>.</p>
+for Web Authentication’s <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①④">PublicKeyCredential</a></code> type, so it always throws an error.</p>
+    <p class="note" role="note"><span>Note:</span> This algorithm is synchronous; the <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise④">Promise</a></code> resolution/rejection is handled by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store" id="ref-for-dom-credentialscontainer-store">navigator.credentials.store()</a></code>.</p>
     <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①③">internal method</a> accepts two arguments:</p>
     <dl>
      <dt data-md><dfn class="idl-code" data-dfn-for="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-store-credential-sameoriginwithancestors-credential"><code>credential</code><a class="self-link" href="#dom-publickeycredential-store-credential-sameoriginwithancestors-credential"></a></dfn>
      <dd data-md>
-      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①③">PublicKeyCredential</a></code> object.</p>
+      <p>This argument is a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑤">PublicKeyCredential</a></code> object.</p>
      <dt data-md><dfn class="idl-code" data-dfn-for="PublicKeyCredential/[[Store]](credential, sameOriginWithAncestors)" data-dfn-type="argument" data-export id="dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors"><code>sameOriginWithAncestors</code><a class="self-link" href="#dom-publickeycredential-store-credential-sameoriginwithancestors-sameoriginwithancestors"></a></dfn>
      <dd data-md>
       <p>This argument is a Boolean value which is <code>true</code> if and only if the caller’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#environment-settings-object" id="ref-for-environment-settings-object②">environment settings object</a> is <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors" id="ref-for-same-origin-with-its-ancestors②">same-origin with its ancestors</a>.</p>
@@ -2649,7 +2877,7 @@ <h4 class="heading settled" data-level="5.1.5" id="sctn-storeCredential"><span c
     <p>When this method is invoked, the user agent MUST execute the following algorithm:</p>
     <ol>
      <li data-md>
-      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑤">DOMException</a></code>.</p>
+      <p>Throw a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror②">NotSupportedError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code>.</p>
     </ol>
    </div>
    <h4 class="heading settled" data-level="5.1.6" id="sctn-preventSilentAccessCredential"><span class="secno">5.1.6. </span><span class="content">Preventing Silent Access to an Existing Credential - PublicKeyCredential’s <code>[[preventSilentAccess]](credential, sameOriginWithAncestors)</code> Method</span><a class="self-link" href="#sctn-preventSilentAccessCredential"></a></h4>
@@ -2662,10 +2890,10 @@ <h4 class="heading settled" data-level="5.1.6" id="sctn-preventSilentAccessCrede
    <h4 class="heading settled" data-level="5.1.7" id="sctn-isUserVerifyingPlatformAuthenticatorAvailable"><span class="secno">5.1.7. </span><span class="content">Availability of <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator②">User-Verifying Platform Authenticator</a> - PublicKeyCredential’s <code>isUserVerifyingPlatformAuthenticatorAvailable()</code> Method</span><a class="self-link" href="#sctn-isUserVerifyingPlatformAuthenticatorAvailable"></a></h4>
    <div data-link-for-hint="WebAuthentication/isUserVerifyingPlatformAuthenticatorAvailable">
     <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①③">WebAuthn Relying Parties</a> use this method to determine whether they can create a new credential using a <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator③">user-verifying platform authenticator</a>.
-Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②④">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑦">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
+Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑥">client</a> employs a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">client platform</a>-specific procedure to discover available <a data-link-type="dfn" href="#user-verifying-platform-authenticator" id="ref-for-user-verifying-platform-authenticator④">user-verifying platform authenticators</a>.
 If any are discovered, the promise is resolved with the value of <code>true</code>.
 Otherwise, the promise is resolved with the value of <code>false</code>.
-Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨①">Relying Party</a> can take further actions to guide the user to create a credential.</p>
+Based on the result, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Party</a> can take further actions to guide the user to create a credential.</p>
     <p>This method has no arguments and returns a Boolean value.</p>
     <div class="mdn-anno wrapped">
      <button class="mdn-anno-btn"><b class="all-engines-flag" title="This feature is in all current engines.">✔</b><span>MDN</span></button>
@@ -2675,19 +2903,89 @@ <h4 class="heading settled" data-level="5.1.7" id="sctn-isUserVerifyingPlatformA
       <div class="support">
        <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
        <hr>
-       <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+       <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
        <hr>
        <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
        <hr>
-       <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>49+</span></span>
+       <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>?</span></span>
       </div>
      </div>
     </div>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①④"><c- g>PublicKeyCredential</c-></a> {
-    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise④"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑥"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise" id="ref-for-idl-promise⑤"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="isUserVerifyingPlatformAuthenticatorAvailable()" id="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></dfn>();
+};
+</pre>
+    <p class="note" role="note"><span>Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①①">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
+   </div>
+   <h4 class="heading settled" data-level="5.1.8" id="sctn-parseCreationOptionsFromJSON"><span class="secno">5.1.8. </span><span class="content">Deserialize Registration ceremony options - PublicKeyCredential’s <code>parseCreationOptionsFromJSON()</code> Method</span><a class="self-link" href="#sctn-parseCreationOptionsFromJSON"></a></h4>
+   <div data-link-for-hint="WebAuthentication/parseCreationOptionsFromJSON">
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types①">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①②">navigator.credentials.create()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②">PublicKeyCredentialCreationOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">options</a></code> argument into a new,
+identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions③">PublicKeyCredentialCreationOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑧">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①②">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a></code> that correspond
+to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions④">PublicKeyCredentialCreationOptions</a></code>. This conversion MUST
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a>.</p>
+    <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
+"WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types②">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code> with a description of the incompatible
+value and terminate the operation.</p>
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑦"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑤"><c- n>PublicKeyCredentialCreationOptions</c-></a> <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseCreationOptionsFromJSON(options)" id="dom-publickeycredential-parsecreationoptionsfromjson"><code><c- g>parseCreationOptionsFromJSON</c-></code><a class="self-link" href="#dom-publickeycredential-parsecreationoptionsfromjson"></a></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptionsjson" id="ref-for-dictdef-publickeycredentialcreationoptionsjson①"><c- n>PublicKeyCredentialCreationOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseCreationOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parsecreationoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialcreationoptionsjson"><code><c- g>PublicKeyCredentialCreationOptionsJSON</c-></code></dfn> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity"><c- n>PublicKeyCredentialRpEntity</c-></a>                    <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="PublicKeyCredentialRpEntity                    " id="dom-publickeycredentialcreationoptionsjson-rp"><code><c- g>rp</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-rp"></a></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentityjson" id="ref-for-dictdef-publickeycredentialuserentityjson"><c- n>PublicKeyCredentialUserEntityJSON</c-></a>              <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="PublicKeyCredentialUserEntityJSON              " id="dom-publickeycredentialcreationoptionsjson-user"><code><c- g>user</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-user"></a></dfn>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①⓪"><c- n>Base64URLString</c-></a>                                <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString                                " id="dom-publickeycredentialcreationoptionsjson-challenge"><code><c- g>challenge</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-challenge"></a></dfn>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters"><c- n>PublicKeyCredentialParameters</c-></a>>        <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<PublicKeyCredentialParameters>        " id="dom-publickeycredentialcreationoptionsjson-pubkeycredparams"><code><c- g>pubKeyCredParams</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-pubkeycredparams"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                                           <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="unsigned long                                           " id="dom-publickeycredentialcreationoptionsjson-timeout"><code><c- g>timeout</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-timeout"></a></dfn>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptorjson" id="ref-for-dictdef-publickeycredentialdescriptorjson"><c- n>PublicKeyCredentialDescriptorJSON</c-></a>>             <dfn class="idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<PublicKeyCredentialDescriptorJSON>             " id="dom-publickeycredentialcreationoptionsjson-excludecredentials"><code><c- g>excludeCredentials</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-excludecredentials"></a></dfn> = [];
+    <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria"><c- n>AuthenticatorSelectionCriteria</c-></a>                          <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="AuthenticatorSelectionCriteria                          " id="dom-publickeycredentialcreationoptionsjson-authenticatorselection"><code><c- g>authenticatorSelection</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-authenticatorselection"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③"><c- b>DOMString</c-></a>                                               <dfn class="idl-code" data-default="&quot;none&quot;" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString                                               " id="dom-publickeycredentialcreationoptionsjson-attestation"><code><c- g>attestation</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-attestation"></a></dfn> = "none";
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson①"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <dfn class="idl-code" data-dfn-for="PublicKeyCredentialCreationOptionsJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientInputsJSON                " id="dom-publickeycredentialcreationoptionsjson-extensions"><code><c- g>extensions</c-></code><a class="self-link" href="#dom-publickeycredentialcreationoptionsjson-extensions"></a></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentityjson"><code><c- g>PublicKeyCredentialUserEntityJSON</c-></code></dfn> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①①"><c- n>Base64URLString</c-></a>        <dfn class="idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString        " id="dom-publickeycredentialuserentityjson-id"><code><c- g>id</c-></code><a class="self-link" href="#dom-publickeycredentialuserentityjson-id"></a></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①④"><c- b>DOMString</c-></a>              <dfn class="idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="DOMString              " id="dom-publickeycredentialuserentityjson-name"><code><c- g>name</c-></code><a class="self-link" href="#dom-publickeycredentialuserentityjson-name"></a></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑤"><c- b>DOMString</c-></a>              <dfn class="idl-code" data-dfn-for="PublicKeyCredentialUserEntityJSON" data-dfn-type="dict-member" data-export data-type="DOMString              " id="dom-publickeycredentialuserentityjson-displayname"><code><c- g>displayName</c-></code><a class="self-link" href="#dom-publickeycredentialuserentityjson-displayname"></a></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialdescriptorjson"><code><c- g>PublicKeyCredentialDescriptorJSON</c-></code></dfn> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①②"><c- n>Base64URLString</c-></a>        <dfn class="idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString        " id="dom-publickeycredentialdescriptorjson-id"><code><c- g>id</c-></code><a class="self-link" href="#dom-publickeycredentialdescriptorjson-id"></a></dfn>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑥"><c- b>DOMString</c-></a>              <dfn class="idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="DOMString              " id="dom-publickeycredentialdescriptorjson-type"><code><c- g>type</c-></code><a class="self-link" href="#dom-publickeycredentialdescriptorjson-type"></a></dfn>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence③"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑦"><c- b>DOMString</c-></a>>             <dfn class="idl-code" data-dfn-for="PublicKeyCredentialDescriptorJSON" data-dfn-type="dict-member" data-export data-type="sequence<DOMString>             " id="dom-publickeycredentialdescriptorjson-transports"><code><c- g>transports</c-></code><a class="self-link" href="#dom-publickeycredentialdescriptorjson-transports"></a></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientinputsjson"><code><c- g>AuthenticationExtensionsClientInputsJSON</c-></code></dfn> {
+};
+</pre>
+   </div>
+   <h4 class="heading settled" data-level="5.1.9" id="sctn-parseRequestOptionsFromJSON"><span class="secno">5.1.9. </span><span class="content">Deserialize Authentication ceremony options - PublicKeyCredential’s <code>parseRequestOptionsFromJSON()</code> Methods</span><a class="self-link" href="#sctn-parseRequestOptionsFromJSON"></a></h4>
+   <div data-link-for-hint="WebAuthentication/parseRequestOptionsFromJSON">
+    <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Parties</a> use this method to convert <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types③">JSON type</a> representations of options for <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑨">navigator.credentials.get()</a></code> into <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code>.</p>
+    <p>Upon invocation, the <a data-link-type="dfn" href="#client" id="ref-for-client③⓪">client</a> MUST convert the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-parserequestoptionsfromjson-options-options" id="ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">options</a></code> argument into a new,
+identically-structured <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑤">PublicKeyCredentialRequestOptions</a></code> object, using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑨">base64url encoding</a> to decode any <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑧">DOMString</a></code> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a></code> that correspond
+to <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type" id="ref-for-dfn-buffer-source-type①">buffer source type</a> attributes in <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑥">PublicKeyCredentialRequestOptions</a></code>. This conversion MUST
+also apply to any <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> processed by the <a data-link-type="dfn" href="#client" id="ref-for-client③①">client</a>.</p>
+    <p><code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson②">AuthenticationExtensionsClientInputsJSON</a></code> MAY include extensions registered in the IANA
+"WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> but not defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.</p>
+    <p>If the <a data-link-type="dfn" href="#client" id="ref-for-client③②">client</a> encounters any issues parsing any of the <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#dfn-json-types" id="ref-for-dfn-json-types④">JSON type</a> representations then it
+MUST throw an "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#encodingerror" id="ref-for-encodingerror①">EncodingError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code> with a description of the incompatible
+value and terminate the operation.</p>
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential" id="ref-for-publickeycredential①⑧"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑦"><c- n>PublicKeyCredentialRequestOptions</c-></a> <dfn class="idl-code" data-dfn-for="PublicKeyCredential" data-dfn-type="method" data-export data-lt="parseRequestOptionsFromJSON(options)" id="dom-publickeycredential-parserequestoptionsfromjson"><code><c- g>parseRequestOptionsFromJSON</c-></code><a class="self-link" href="#dom-publickeycredential-parserequestoptionsfromjson"></a></dfn>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptionsjson" id="ref-for-dictdef-publickeycredentialrequestoptionsjson①"><c- n>PublicKeyCredentialRequestOptionsJSON</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredential/parseRequestOptionsFromJSON(options)" data-dfn-type="argument" data-export id="dom-publickeycredential-parserequestoptionsfromjson-options-options"><code><c- g>options</c-></code></dfn>);
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptionsjson"><code><c- g>PublicKeyCredentialRequestOptionsJSON</c-></code></dfn> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring" id="ref-for-typedefdef-base64urlstring①③"><c- n>Base64URLString</c-></a>                                <dfn class="idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="Base64URLString                                " id="dom-publickeycredentialrequestoptionsjson-challenge"><code><c- g>challenge</c-></code><a class="self-link" href="#dom-publickeycredentialrequestoptionsjson-challenge"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long①"><c- b>unsigned</c-> <c- b>long</c-></a>                                           <dfn class="idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="unsigned long                                           " id="dom-publickeycredentialrequestoptionsjson-timeout"><code><c- g>timeout</c-></code><a class="self-link" href="#dom-publickeycredentialrequestoptionsjson-timeout"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑨"><c- b>DOMString</c-></a>                                               <dfn class="idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString                                               " id="dom-publickeycredentialrequestoptionsjson-rpid"><code><c- g>rpId</c-></code><a class="self-link" href="#dom-publickeycredentialrequestoptionsjson-rpid"></a></dfn>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence④"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptorjson" id="ref-for-dictdef-publickeycredentialdescriptorjson①"><c- n>PublicKeyCredentialDescriptorJSON</c-></a>>             <dfn class="idl-code" data-default="[]" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="sequence<PublicKeyCredentialDescriptorJSON>             " id="dom-publickeycredentialrequestoptionsjson-allowcredentials"><code><c- g>allowCredentials</c-></code><a class="self-link" href="#dom-publickeycredentialrequestoptionsjson-allowcredentials"></a></dfn> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⓪"><c- b>DOMString</c-></a>                                               <dfn class="idl-code" data-default="&quot;preferred&quot;" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="DOMString                                               " id="dom-publickeycredentialrequestoptionsjson-userverification"><code><c- g>userVerification</c-></code><a class="self-link" href="#dom-publickeycredentialrequestoptionsjson-userverification"></a></dfn> = "preferred";
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson" id="ref-for-dictdef-authenticationextensionsclientinputsjson③"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <dfn class="idl-code" data-dfn-for="PublicKeyCredentialRequestOptionsJSON" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsClientInputsJSON                " id="dom-publickeycredentialrequestoptionsjson-extensions"><code><c- g>extensions</c-></code><a class="self-link" href="#dom-publickeycredentialrequestoptionsjson-extensions"></a></dfn>;
 };
 </pre>
-    <p class="note" role="note"><span>Note:</span> Invoking this method from a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context" id="ref-for-browsing-context①">browsing context</a> where the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①①">Web Authentication API</a> is "disabled" according to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use">allowed to use</a> algorithm—i.e., by a <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy①">permissions policy</a>—will result in the promise being rejected with a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑥">DOMException</a></code> whose name is "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑧">NotAllowedError</a></code>". See also <a href="#sctn-permissions-policy">§ 5.9 Permissions Policy integration</a>.</p>
    </div>
    <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><span class="secno">5.2. </span><span class="content">Authenticator Responses (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorresponse"><code>AuthenticatorResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorresponse"></a></h3>
    <div class="mdn-anno wrapped after">
@@ -2698,18 +2996,18 @@ <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><s
      <div class="support">
       <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
       <hr>
-      <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+      <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
       <hr>
       <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
       <hr>
-      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
      </div>
     </div>
    </div>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧②">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨②">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">Authenticators</a> respond to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Party</a> requests by returning an object derived from the <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse②">AuthenticatorResponse</a></code> interface:</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext①"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed①"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse" id="ref-for-authenticatorresponse③"><c- g>AuthenticatorResponse</c-></a> {
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject③"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①①"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson②"><c- g>clientDataJSON</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject③"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①④"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③"><c- g>clientDataJSON</c-></a>;
 };
 </pre>
    <div>
@@ -2723,18 +3021,18 @@ <h3 class="heading settled" data-level="5.2" id="iface-authenticatorresponse"><s
         <div class="support">
          <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
          <hr>
-         <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+         <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
          <hr>
          <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
          <hr>
-         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
         </div>
        </div>
       </div>
-      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorResponse" data-dfn-type="attribute" data-export id="dom-authenticatorresponse-clientdatajson"><code>clientDataJSON</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①②">ArrayBuffer</a>, readonly</span></p>
+      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorResponse" data-dfn-type="attribute" data-export id="dom-authenticatorresponse-clientdatajson"><code>clientDataJSON</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤">ArrayBuffer</a>, readonly</span></p>
      <dd data-md>
-      <p>This attribute contains a <a href="#clientdatajson-serialization">JSON-compatible serialization</a> of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data">client data</a>, the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②">hash of which</a> is passed to the
-authenticator by the client in its call to either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①②">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get①⑨">get()</a></code> (i.e., the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①">client data</a> itself is not sent to the authenticator).</p>
+      <p>This attribute contains a <a href="#clientdatajson-serialization">JSON-compatible serialization</a> of the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data">client data</a>, the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data③">hash of which</a> is passed to the
+authenticator by the client in its call to either <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①③">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⓪">get()</a></code> (i.e., the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①">client data</a> itself is not sent to the authenticator).</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestationresponse"><span class="secno">5.2.1. </span><span class="content">Information About Public Key Credential (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorattestationresponse"><code>AuthenticatorAttestationResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorattestationresponse"></a></h4>
@@ -2746,17 +3044,17 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
      <div class="support">
       <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
       <hr>
-      <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+      <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
       <hr>
       <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
       <hr>
-      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
      </div>
     </div>
    </div>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧③">authenticator</a>'s response to a client’s request
-for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⓪">public key credential</a>. It contains information about the new credential that can be used to
-identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①④">WebAuthn Relying Party</a> to assess the characteristics of the credential
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse②">AuthenticatorAttestationResponse</a></code> interface represents the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a>'s response to a client’s request
+for the creation of a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credential</a>. It contains information about the new credential that can be used to
+identify it for later use, and metadata that can be used by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Party</a> to assess the characteristics of the credential
 during registration.</p>
    <div class="mdn-anno wrapped">
     <button class="mdn-anno-btn"><span>MDN</span></button>
@@ -2765,29 +3063,29 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
      <div class="support">
       <span class="firefox no"><span>Firefox</span><span>None</span></span><span class="safari yes"><span>Safari</span><span>16+</span></span><span class="chrome yes"><span>Chrome</span><span>74+</span></span>
       <hr>
-      <span class="opera yes"><span>Opera</span><span>62+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+      <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
       <hr>
-      <span class="edge no"><span>Edge (Legacy)</span><span>None</span></span><span class="ie no"><span>IE</span><span>None</span></span>
+      <span class="edge no"><span>Edge (Legacy)</span><span>?</span></span><span class="ie no"><span>IE</span><span>None</span></span>
       <hr>
-      <span class="firefox_android no"><span>Firefox for Android</span><span>None</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>16+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>74+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>53+</span></span>
+      <span class="firefox_android no"><span>Firefox for Android</span><span>?</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android no"><span>Chrome for Android</span><span>?</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>?</span></span>
      </div>
     </div>
    </div>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext②"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed②"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse③"><c- g>AuthenticatorAttestationResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse④"><c- n>AuthenticatorResponse</c-></a> {
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①③"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject①"><c- g>attestationObject</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④"><c- b>DOMString</c-></a>>                              <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getTransports()" id="dom-authenticatorattestationresponse-gettransports"><code><c- g>getTransports</c-></code></dfn>();
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①④"><c- b>ArrayBuffer</c-></a>                                      <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getAuthenticatorData()" id="dom-authenticatorattestationresponse-getauthenticatordata"><code><c- g>getAuthenticatorData</c-></code></dfn>();
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑤"><c- b>ArrayBuffer</c-></a>?                                     <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKey()" id="dom-authenticatorattestationresponse-getpublickey"><code><c- g>getPublicKey</c-></code></dfn>();
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject④"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑥"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject②"><c- g>attestationObject</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②①"><c- b>DOMString</c-></a>>                              <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getTransports()" id="dom-authenticatorattestationresponse-gettransports"><code><c- g>getTransports</c-></code></dfn>();
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑦"><c- b>ArrayBuffer</c-></a>                                      <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getAuthenticatorData()" id="dom-authenticatorattestationresponse-getauthenticatordata"><code><c- g>getAuthenticatorData</c-></code></dfn>();
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑧"><c- b>ArrayBuffer</c-></a>?                                     <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKey()" id="dom-authenticatorattestationresponse-getpublickey"><code><c- g>getPublicKey</c-></code></dfn>();
     <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier②"><c- n>COSEAlgorithmIdentifier</c-></a>                          <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="method" data-export data-lt="getPublicKeyAlgorithm()" id="dom-authenticatorattestationresponse-getpublickeyalgorithm"><code><c- g>getPublicKeyAlgorithm</c-></code></dfn>();
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson③">clientDataJSON</a></code>
+     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson④">clientDataJSON</a></code>
      <dd data-md>
       <p>This attribute, inherited from <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑤">AuthenticatorResponse</a></code>, contains the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data②">JSON-compatible serialization of client data</a> (see <a href="#sctn-attestation">§ 6.5 Attestation</a>) passed to the authenticator by the client in order to generate this credential. The
-exact JSON serialization MUST be preserved, as the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data③">hash of the serialized client data</a> has been computed
+exact JSON serialization MUST be preserved, as the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data④">hash of the serialized client data</a> has been computed
 over it.</p>
      <dt data-md>
       <div class="mdn-anno wrapped">
@@ -2798,27 +3096,27 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
         <div class="support">
          <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
          <hr>
-         <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+         <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
          <hr>
          <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
          <hr>
-         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
         </div>
        </div>
       </div>
-      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-attestationobject"><code>attestationObject</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑥">ArrayBuffer</a>, readonly</span></p>
+      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-attestationobject"><code>attestationObject</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑨">ArrayBuffer</a>, readonly</span></p>
      <dd data-md>
       <p>This attribute contains an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object④">attestation object</a>, which is opaque to, and cryptographically protected against
-tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④">attestation
-statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⓪">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①②">credential public key</a>. The
-contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧④">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨③">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
+tampering by, the client. The <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑤">attestation object</a> contains both <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> and an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑤">attestation
+statement</a>. The former contains the AAGUID, a unique <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential ID</a>, and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a>. The
+contents of the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑥">attestation statement</a> are determined by the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format">attestation statement format</a> used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">authenticator</a>. It also contains any additional information that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Party</a>'s server requires to validate the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a>, as well as to decode and validate the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a> along with the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data③">JSON-compatible serialization of client data</a>. For more details, see <a href="#sctn-attestation">§ 6.5 Attestation</a>, <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>,
 and <a href="#fig-attStructs">Figure 6</a>.</p>
-     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports">getTransports()</a></code>
+     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>
      <dd data-md>
       <p>This operation returns the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-transports-slot" id="ref-for-dom-authenticatorattestationresponse-transports-slot①">[[transports]]</a></code>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata">getAuthenticatorData()</a></code>
      <dd data-md>
-      <p>This operation returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑥">authenticator data</a> contained within <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject②">attestationObject</a></code>. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
+      <p>This operation returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑧">authenticator data</a> contained within <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject③">attestationObject</a></code>. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey">getPublicKey()</a></code>
      <dd data-md>
       <p>This operation returns the DER <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7">SubjectPublicKeyInfo</a> of the new credential, or null if this is not available. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
@@ -2827,14 +3125,14 @@ <h4 class="heading settled" data-level="5.2.1" id="iface-authenticatorattestatio
       <p>This operation returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier③">COSEAlgorithmIdentifier</a></code> of the new credential. See <a href="#sctn-public-key-easy">§ 5.2.1.1 Easily accessing credential data</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAttestationResponse" data-dfn-type="attribute" data-export id="dom-authenticatorattestationresponse-transports-slot"><code>[[transports]]</code></dfn>
      <dd data-md>
-      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑤">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑤">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨④">Relying Parties</a> SHOULD accept and store unknown values.</p>
+      <p>This <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑤">internal slot</a> contains a sequence of zero or more unique <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②②">DOMString</a></code>s in lexicographical order. These values are the transports that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">authenticator</a> is believed to support, or an empty sequence if the information is unavailable. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport①">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Parties</a> SHOULD accept and store unknown values.</p>
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span class="secno">5.2.1.1. </span><span class="content">Easily accessing credential data</span><a class="self-link" href="#sctn-public-key-easy"></a></h5>
-   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①③">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> is in <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a> (COSE) format, inside the <a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑦">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject③">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑤">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑥">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑧">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> into a more convenient format.</p>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey①">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑦">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
-   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑥">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑦">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑦">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> will be null.</p>
-   <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> value of:</p>
+   <p>Every user of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot②">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method will need to parse and store the returned <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①④">credential public key</a> in order to verify future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⓪">authentication assertions</a>. However, the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑤">credential public key</a> is in <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a> (COSE) format, inside the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a> member of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①">attestedCredentialData</a>, inside the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a>, inside the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑥">attestation object</a> conveyed by <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse④">AuthenticatorAttestationResponse</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject④">attestationObject</a></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Parties</a> wishing to use <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑥">attestation</a> are obliged to do the work of parsing the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code> and obtaining the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑥">credential public key</a> because that public key copy is the one the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a> <a href="#signing-procedure" id="ref-for-signing-procedure">signed</a>. However, many valid WebAuthn use cases do not require <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑦">attestation</a>. For those uses, user agents can do the work of parsing, expose the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> directly, and translate the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑦">credential public key</a> into a more convenient format.</p>
+   <p>The <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey①">getPublicKey()</a></code> operation thus returns the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑧">credential public key</a> as a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7①">SubjectPublicKeyInfo</a>. This <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⓪">ArrayBuffer</a></code> can, for example, be passed to Java’s <code>java.security.spec.X509EncodedKeySpec</code>, .NET’s <code>System.Security.Cryptography.ECDsa.ImportSubjectPublicKeyInfo</code>, or Go’s <code>crypto/x509.ParsePKIXPublicKey</code>.</p>
+   <p>Use of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey②">getPublicKey()</a></code> does impose some limitations: by using <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams②">pubKeyCredParams</a></code>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a> can negotiate with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a> to use public key algorithms that the user agent may not understand. However, if the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> does so, the user agent will not be able to translate the resulting <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key①⑨">credential public key</a> into <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7②">SubjectPublicKeyInfo</a> format and the return value of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey③">getPublicKey()</a></code> will be null.</p>
+   <p>User agents MUST be able to return a non-null value for <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey④">getPublicKey()</a></code> when the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a> has a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier④">COSEAlgorithmIdentifier</a></code> value of:</p>
    <ul>
     <li data-md>
      <p>-7 (ES256), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7.1" id="ref-for-section-7.1">kty</a> is 2 (with uncompressed points) and <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-13.1.1" id="ref-for-section-13.1.1">crv</a> is 1 (P-256).</p>
@@ -2843,9 +3141,9 @@ <h5 class="heading settled" data-level="5.2.1.1" id="sctn-public-key-easy"><span
     <li data-md>
      <p>-8 (EdDSA), where <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-13.1.1" id="ref-for-section-13.1.1①">crv</a> is 6 (Ed25519).</p>
    </ul>
-   <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm①">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⓪">credential public key</a>.</p>
-   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑨">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑤">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⓪">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑧">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party⑨⑨">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
-   <p class="note" role="note"><span>Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⓪">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪①">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
+   <p>A <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc5280#section-4.1.2.7" id="ref-for-section-4.1.2.7③">SubjectPublicKeyInfo</a> does not include information about the signing algorithm (for example, which hash function to use) that is included in the COSE public key. To provide this, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickeyalgorithm" id="ref-for-dom-authenticatorattestationresponse-getpublickeyalgorithm①">getPublicKeyAlgorithm()</a></code> returns the <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑤">COSEAlgorithmIdentifier</a></code> for the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public key</a>.</p>
+   <p>To remove the need to parse CBOR at all in many cases, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata①">getAuthenticatorData()</a></code> returns the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①①">authenticator data</a> from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code>. The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> contains other fields that are encoded in a binary format. However, helper functions are not provided to access them because <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Parties</a> already need to extract those fields when <a href="#sctn-getAssertion">getting an assertion</a>. In contrast to <a href="#sctn-createCredential">credential creation</a>, where signature verification is <a href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference">optional</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Parties</a> should always be verifying signatures from an assertion and thus must extract fields from the signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">authenticator data</a>. The same functions used there will also serve during credential creation.</p>
+   <p class="note" role="note"><span>Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getpublickey" id="ref-for-dom-authenticatorattestationresponse-getpublickey⑤">getPublicKey()</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-getauthenticatordata" id="ref-for-dom-authenticatorattestationresponse-getauthenticatordata②">getAuthenticatorData()</a></code> were only added in level two of this spec. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Parties</a> SHOULD use feature detection before using these functions by testing the value of <code>'getPublicKey' in AuthenticatorAttestationResponse.prototype</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Parties</a> that require this function to exist may not interoperate with older user-agents.</p>
    <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionresponse"><span class="secno">5.2.2. </span><span class="content">Web Authentication Assertion (interface <dfn class="dfn-paneled idl-code" data-dfn-type="interface" data-export id="authenticatorassertionresponse"><code>AuthenticatorAssertionResponse</code></dfn>)</span><a class="self-link" href="#iface-authenticatorassertionresponse"></a></h4>
    <div class="mdn-anno wrapped after">
     <button class="mdn-anno-btn"><b class="all-engines-flag" title="This feature is in all current engines.">✔</b><span>MDN</span></button>
@@ -2855,31 +3153,31 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
      <div class="support">
       <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
       <hr>
-      <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+      <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
       <hr>
       <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
       <hr>
-      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+      <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
      </div>
     </div>
    </div>
-   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑧">authenticator</a>'s response to a client’s request for
-generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑤">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
+   <p>The <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse③">AuthenticatorAssertionResponse</a></code> interface represents an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a>'s response to a client’s request for
+generation of a new <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①①">authentication assertion</a> given the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Party</a>'s challenge and OPTIONAL list of credentials it is
 aware of. This response contains a cryptographic signature proving possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑧">credential private key</a>, and
 optionally evidence of <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①①">user consent</a> to a specific transaction.</p>
 <pre class="idl highlight def">[<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext" id="ref-for-SecureContext③"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed" id="ref-for-Exposed③"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse④"><c- g>AuthenticatorAssertionResponse</c-></a> : <a data-link-type="idl-name" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑥"><c- n>AuthenticatorResponse</c-></a> {
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑤"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑧"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑥"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer①⑨"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature①"><c- g>signature</c-></a>;
-    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑦"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⓪"><c- b>ArrayBuffer</c-></a>?     <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer?" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle③"><c- g>userHandle</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑤"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata①"><c- g>authenticatorData</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑥"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②②"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature①"><c- g>signature</c-></a>;
+    [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject" id="ref-for-SameObject⑦"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②③"><c- b>ArrayBuffer</c-></a>?     <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer?" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle③"><c- g>userHandle</c-></a>;
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson④">clientDataJSON</a></code>
+     <dt data-md><code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑤">clientDataJSON</a></code>
      <dd data-md>
       <p>This attribute, inherited from <code class="idl"><a data-link-type="idl" href="#authenticatorresponse" id="ref-for-authenticatorresponse⑦">AuthenticatorResponse</a></code>, contains the <a data-link-type="dfn" href="#collectedclientdata-json-compatible-serialization-of-client-data" id="ref-for-collectedclientdata-json-compatible-serialization-of-client-data④">JSON-compatible serialization of client data</a> (see <a href="#dictionary-client-data">§ 5.8.1 Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>) passed to the authenticator by the client in order to generate this assertion. The
-exact JSON serialization MUST be preserved, as the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data④">hash of the serialized client data</a> has been computed
+exact JSON serialization MUST be preserved, as the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑤">hash of the serialized client data</a> has been computed
 over it.</p>
      <dt data-md>
       <div class="mdn-anno wrapped">
@@ -2890,17 +3188,17 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
         <div class="support">
          <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
          <hr>
-         <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+         <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
          <hr>
          <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
          <hr>
-         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
         </div>
        </div>
       </div>
-      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-authenticatordata"><code>authenticatorData</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②①">ArrayBuffer</a>, readonly</span></p>
+      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-authenticatordata"><code>authenticatorData</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②④">ArrayBuffer</a>, readonly</span></p>
      <dd data-md>
-      <p>This attribute contains the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①②">authenticator data</a> returned by the authenticator. See <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a>.</p>
+      <p>This attribute contains the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①④">authenticator data</a> returned by the authenticator. See <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a>.</p>
      <dt data-md>
       <div class="mdn-anno wrapped">
        <button class="mdn-anno-btn"><b class="all-engines-flag" title="This feature is in all current engines.">✔</b><span>MDN</span></button>
@@ -2910,15 +3208,15 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
         <div class="support">
          <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
          <hr>
-         <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+         <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
          <hr>
          <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
          <hr>
-         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
         </div>
        </div>
       </div>
-      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-signature"><code>signature</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②②">ArrayBuffer</a>, readonly</span></p>
+      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-signature"><code>signature</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑤">ArrayBuffer</a>, readonly</span></p>
      <dd data-md>
       <p>This attribute contains the raw signature returned from the authenticator. See <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>.</p>
      <dt data-md>
@@ -2930,31 +3228,31 @@ <h4 class="heading settled" data-level="5.2.2" id="iface-authenticatorassertionr
         <div class="support">
          <span class="firefox yes"><span>Firefox</span><span>60+</span></span><span class="safari yes"><span>Safari</span><span>13+</span></span><span class="chrome yes"><span>Chrome</span><span>67+</span></span>
          <hr>
-         <span class="opera yes"><span>Opera</span><span>54+</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
+         <span class="opera no"><span>Opera</span><span>?</span></span><span class="edge_blink yes"><span>Edge</span><span>79+</span></span>
          <hr>
          <span class="edge yes"><span>Edge (Legacy)</span><span>18</span></span><span class="ie no"><span>IE</span><span>None</span></span>
          <hr>
-         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios yes"><span>iOS Safari</span><span>13+</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>None</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
+         <span class="firefox_android yes"><span>Firefox for Android</span><span>92+</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>70+</span></span><span class="webview_android no"><span>Android WebView</span><span>None</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android yes"><span>Opera Mobile</span><span>48+</span></span>
         </div>
        </div>
       </div>
-      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-userhandle"><code>userHandle</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②③">ArrayBuffer</a>, readonly, nullable</span></p>
+      <p><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorAssertionResponse" data-dfn-type="attribute" data-export id="dom-authenticatorassertionresponse-userhandle"><code>userHandle</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑥">ArrayBuffer</a>, readonly, nullable</span></p>
      <dd data-md>
       <p>This attribute contains the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle⑨">user handle</a> returned from the authenticator, or null if the authenticator did not return a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⓪">user handle</a>. See <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><span class="secno">5.3. </span><span class="content">Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialparameters"><code>PublicKeyCredentialParameters</code></dfn>)</span><a class="self-link" href="#dictionary-credential-params"></a></h3>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters"><c- g>PublicKeyCredentialParameters</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑥"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type②"><c- g>type</c-></a>;
+<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters①"><c- g>PublicKeyCredentialParameters</c-></a> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type②"><c- g>type</c-></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑥"><c- n>COSEAlgorithmIdentifier</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="COSEAlgorithmIdentifier      " href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg①"><c- g>alg</c-></a>;
 };
 </pre>
    <div>
      This dictionary is used to supply additional parameters when creating a new credential. 
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑦">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②④">DOMString</a></span>
      <dd data-md>
-      <p>This member specifies the type of credential to be created. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype④">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑧">client platforms</a> MUST ignore unknown values, ignoring any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters①">PublicKeyCredentialParameters</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type③">type</a></code>.</p>
+      <p>This member specifies the type of credential to be created. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype④">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platforms</a> MUST ignore unknown values, ignoring any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters②">PublicKeyCredentialParameters</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-type" id="ref-for-dom-publickeycredentialparameters-type③">type</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialParameters" data-dfn-type="dict-member" data-export id="dom-publickeycredentialparameters-alg"><code>alg</code></dfn>, <span> of type <a data-link-type="idl-name" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑦">COSEAlgorithmIdentifier</a></span>
      <dd data-md>
       <p>This member specifies the cryptographic signature algorithm with which the newly generated credential will be used, and
@@ -2964,217 +3262,217 @@ <h3 class="heading settled" data-level="5.3" id="dictionary-credential-params"><
         a message to the authenticator, which may be sent over a low-bandwidth link.</p>
    </div>
    <h3 class="heading settled" data-level="5.4" id="dictionary-makecredentialoptions"><span class="secno">5.4. </span><span class="content">Options for Credential Creation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialcreationoptions"><code>PublicKeyCredentialCreationOptions</code></dfn>)</span><a class="self-link" href="#dictionary-makecredentialoptions"></a></h3>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions②"><c- g>PublicKeyCredentialCreationOptions</c-></a> {
-    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity"><c- n>PublicKeyCredentialRpEntity</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialRpEntity         " href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑧"><c- g>rp</c-></a>;
+<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑥"><c- g>PublicKeyCredentialCreationOptions</c-></a> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity①"><c- n>PublicKeyCredentialRpEntity</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialRpEntity         " href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑧"><c- g>rp</c-></a>;
     <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity"><c- n>PublicKeyCredentialUserEntity</c-></a>       <a class="idl-code" data-link-type="dict-member" data-type="PublicKeyCredentialUserEntity       " href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user③"><c- g>user</c-></a>;
 
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource②"><c- n>BufferSource</c-></a>                             <a class="idl-code" data-link-type="dict-member" data-type="BufferSource                             " href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge①"><c- g>challenge</c-></a>;
-    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters②"><c- n>PublicKeyCredentialParameters</c-></a>>  <a class="idl-code" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialParameters>  " href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams③"><c- g>pubKeyCredParams</c-></a>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑥"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters③"><c- n>PublicKeyCredentialParameters</c-></a>>  <a class="idl-code" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialParameters>  " href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams③"><c- g>pubKeyCredParams</c-></a>;
 
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                                <a class="idl-code" data-link-type="dict-member" data-type="unsigned long                                " href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout③"><c- g>timeout</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence②"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor③"><c- n>PublicKeyCredentialDescriptor</c-></a>>      <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>      " href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①"><c- g>excludeCredentials</c-></a> = [];
-    <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria"><c- n>AuthenticatorSelectionCriteria</c-></a>               <a class="idl-code" data-link-type="dict-member" data-type="AuthenticatorSelectionCriteria               " href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨"><c- g>authenticatorSelection</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑧"><c- b>DOMString</c-></a>                                    <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString                                    " href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation②"><c- g>attestation</c-></a> = "none";
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long②"><c- b>unsigned</c-> <c- b>long</c-></a>                                <a class="idl-code" data-link-type="dict-member" data-type="unsigned long                                " href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout③"><c- g>timeout</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑦"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑤"><c- n>PublicKeyCredentialDescriptor</c-></a>>      <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor>      " href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials①"><c- g>excludeCredentials</c-></a> = [];
+    <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria①"><c- n>AuthenticatorSelectionCriteria</c-></a>               <a class="idl-code" data-link-type="dict-member" data-type="AuthenticatorSelectionCriteria               " href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨"><c- g>authenticatorSelection</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑤"><c- b>DOMString</c-></a>                                    <a class="idl-code" data-default="&quot;none&quot;" data-link-type="dict-member" data-type="DOMString                                    " href="#dom-publickeycredentialcreationoptions-attestation" id="ref-for-dom-publickeycredentialcreationoptions-attestation②"><c- g>attestation</c-></a> = "none";
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs"><c- n>AuthenticationExtensionsClientInputs</c-></a>         <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsClientInputs         " href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions③"><c- g>extensions</c-></a>;
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-rp"><code>rp</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity①">PublicKeyCredentialRpEntity</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-rp"><code>rp</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity②">PublicKeyCredentialRpEntity</a></span>
      <dd data-md>
-      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪②">Relying Party</a> responsible for the request.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
+      <p>This member contains a name and an identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Party</a> responsible for the request.</p>
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code> member is REQUIRED. See <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> for further
 details.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②①">RP ID</a> the credential
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑦">id</a></code> member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a> the credential
 should be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⓪">scoped</a> to. If omitted, its value will be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer①">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object③">relevant
 settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑥">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①②">effective domain</a>. See <a href="#dictionary-rp-credential-params">§ 5.4.2 Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> for further details.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-user"><code>user</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity①">PublicKeyCredentialUserEntity</a></span>
      <dd data-md>
-      <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①①">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①④">registration</a>.</p>
-      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑧">authentication ceremonies</a>,
-and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑧⑨">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⓪">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client②⑤">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony⑨">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑧">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪③">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⓪">authentication ceremonies</a></p>
+      <p>This member contains names and an identifier for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a> performing the <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a>.</p>
+      <p>Its value’s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name②">name</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname②">displayName</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id②">id</a></code> members are REQUIRED. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id③">id</a></code> can be returned as the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle④">userHandle</a></code> in some future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⓪">authentication ceremonies</a>,
+and is used to overwrite existing <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential④">discoverable credentials</a> that have the same <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-rp" id="ref-for-dom-publickeycredentialcreationoptions-rp⑨">rp</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑧">id</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user④">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id④">id</a></code></code> on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a>. <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code> MAY be used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a> and <a data-link-type="dfn" href="#client" id="ref-for-client③③">client</a> in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①①">authentication ceremonies</a> to help the user select a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credential</a>, but are not returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a> as a result of future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①②">authentication ceremonies</a></p>
       <p>For further details, see <a href="#dictionary-pkcredentialentity">§ 5.4.1 Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> and <a href="#dictionary-user-credential-params">§ 5.4.3 User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource③">BufferSource</a></span>
      <dd data-md>
-      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨①">authenticator</a> signs, along with other data,
+      <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a> signs, along with other data,
 when producing an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑦">attestation object</a> for the newly created credential.
 See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters③">PublicKeyCredentialParameters</a>></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-pubkeycredparams"><code>pubKeyCredParams</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters" id="ref-for-dictdef-publickeycredentialparameters④">PublicKeyCredentialParameters</a>></span>
      <dd data-md>
-      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪④">Relying Party</a> supports,
+      <p>This member lists the key types and signature algorithms the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Party</a> supports,
 ordered from most preferred to least preferred.
-The <a data-link-type="dfn" href="#client" id="ref-for-client②⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨②">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
-If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①③">create()</a></code> operation fails.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long①">unsigned long</a></span>
+The <a data-link-type="dfn" href="#client" id="ref-for-client③④">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a> make a best-effort to create a credential of the most preferred type possible.
+If none of the listed types can be created, the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①④">create()</a></code> operation fails.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
      <dd data-md>
-      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑤">Relying Party</a> is willing to wait for the call to complete. This is
-treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑦">client</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor④">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
+      <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Party</a> is willing to wait for the call to complete. This is
+treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">client</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-excludecredentials"><code>excludeCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑥">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential⑨">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①②">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
-This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨③">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①③">user account</a>.
-If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client②⑧">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨④">authenticator</a>,
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Party</a> SHOULD use this OPTIONAL member to list any existing <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credentials</a> mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a> (as identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑤">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑤">id</a></code>).
+This ensures that the new credential is not <a data-link-type="dfn" href="#created-on" id="ref-for-created-on①">created on</a> an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticator</a> that already <a data-link-type="dfn" href="#contains" id="ref-for-contains①">contains</a> a credential mapped to this <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>.
+If it would be, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> is requested to instead guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticator</a>,
 or return an error if that fails.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria①">AuthenticatorSelectionCriteria</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-authenticatorselection"><code>authenticatorSelection</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑦">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
-that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑤">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①④">create()</a></code> operation.
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Party</a> MAY use this OPTIONAL member to specify capabilities and settings
+that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">authenticator</a> MUST or SHOULD satisfy to participate in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">create()</a></code> operation.
 See <a href="#dictionary-authenticatorSelection">§ 5.4.4 Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑨">DOMString</a>, defaulting to <code>"none"</code></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-attestation"><code>attestation</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥">DOMString</a>, defaulting to <code>"none"</code></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑧">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
-Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform②⑨">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">member does not exist</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Party</a> MAY use this OPTIONAL member to specify a preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance①">attestation conveyance</a>.
+Its value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference④">AttestationConveyancePreference</a></code>. <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③①">Client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists">member does not exist</a>.</p>
       <p>The default value is <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none①">none</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialCreationOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialcreationoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①">AuthenticationExtensionsClientInputs</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⓪⑨">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client②⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑥">authenticator</a>.
-For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⓪">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⓪">credential</a> that was created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticator</a>.
+For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Party</a> may request that the client returns additional information about the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credential</a> that was created.</p>
       <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.1" id="dictionary-pkcredentialentity"><span class="secno">5.4.1. </span><span class="content">Public Key Entity Description (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialentity"><code>PublicKeyCredentialEntity</code></dfn>)</span><a class="self-link" href="#dictionary-pkcredentialentity"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①④">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑥">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③①">public key credential</a> is
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a></code> dictionary describes a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a>, or a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Party</a>, which a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">public key credential</a> is
 associated with or <a data-link-type="dfn" href="#scope" id="ref-for-scope①①">scoped</a> to, respectively.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity①"><c- g>PublicKeyCredentialEntity</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⓪"><c- b>DOMString</c-></a>    <a class="idl-code" data-link-type="dict-member" data-type="DOMString    " href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name③"><c- g>name</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦"><c- b>DOMString</c-></a>    <a class="idl-code" data-link-type="dict-member" data-type="DOMString    " href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④"><c- g>name</c-></a>;
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialentity-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①①">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialentity-name"><code>name</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑧">DOMString</a></span>
      <dd data-md>
       <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability①">human-palatable</a> name for the entity. Its function depends on what the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity②">PublicKeyCredentialEntity</a></code> represents:</p>
       <ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity②">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①①">Relying Party</a>, intended only
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability②">human-palatable</a> identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a>, intended only
 for display. For example, "ACME Corporation", "Wonderful Widgets, Inc." or "ОАО Примертех".</p>
         <ul>
          <li data-md>
-          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①②">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
-when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name④">name</a></code>'s value, or displaying the value to the user.</p>
+          <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
+when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑤">name</a></code>'s value, or displaying the value to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①③">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client③⓪">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑤">name</a></code>'s value prior to displaying the value to the user or
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client③⑧">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑦">authenticatorMakeCredential</a> operation.</p>
         </ul>
        <li data-md>
-        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑤">user account</a>. It is intended only for display, i.e., aiding the user in determining the difference between user
-accounts with similar <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname③">displayName</a></code>s. For example, "alexm", "alex.mueller@example.com"
+        <p>When inherited by <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity②">PublicKeyCredentialUserEntity</a></code>, it is a <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability③">human-palatable</a> identifier for a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>. It is intended only for display, i.e., aiding the user in determining the difference between user
+accounts with similar <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④">displayName</a></code>s. For example, "alexm", "alex.mueller@example.com"
 or "+14255551234".</p>
         <ul>
          <li data-md>
-          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①④">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑤">Relying Party</a> SHOULD perform enforcement,
+          <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Party</a> MAY let the user choose this value. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> SHOULD perform enforcement,
 as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS
-IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑥">name</a></code>'s value, or displaying the value
+IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>, when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑦">name</a></code>'s value, or displaying the value
 to the user.</p>
          <li data-md>
-          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑥">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+          <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
          <li data-md>
-          <p><a data-link-type="dfn" href="#client" id="ref-for-client③①">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑦">name</a></code>'s value prior to displaying the value to the user or
+          <p><a data-link-type="dfn" href="#client" id="ref-for-client③⑨">Clients</a> SHOULD perform enforcement, as prescribed in Section 3.4.3 of <a data-link-type="biblio" href="#biblio-rfc8265">[RFC8265]</a> for the UsernameCasePreserved Profile of the PRECIS IdentifierClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑧">authenticatorMakeCredential</a> operation.</p>
         </ul>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client③②">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⓪">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑦">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑧">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3">[css-overflow-3]</a>.</p>
-      <p>Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code> member’s value so that it fits within 64 bytes, if the authenticator stores the value. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④⓪">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name⑨">name</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3">[css-overflow-3]</a>.</p>
+      <p>Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code> member’s value so that it fits within 64 bytes, if the authenticator stores the value. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.2" id="dictionary-rp-credential-params"><span class="secno">5.4.2. </span><span class="content">Relying Party Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrpentity"><code>PublicKeyCredentialRpEntity</code></dfn>)</span><a class="self-link" href="#dictionary-rp-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity③">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑦">Relying Party</a> attributes when creating a new credential.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①②"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨"><c- g>id</c-></a>;
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity④">PublicKeyCredentialRpEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a> attributes when creating a new credential.</p>
+<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤"><c- g>PublicKeyCredentialRpEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity③"><c- n>PublicKeyCredentialEntity</c-></a> {
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑨"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id⑨"><c- g>id</c-></a>;
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①③">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRpEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrpentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⓪">DOMString</a></span>
      <dd data-md>
-      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑧">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②②">RP ID</a>.</p>
+      <p>A unique identifier for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Party</a> entity, which sets the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.3" id="dictionary-user-credential-params"><span class="secno">5.4.3. </span><span class="content">User Account Parameters for Credential Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialuserentity"><code>PublicKeyCredentialUserEntity</code></dfn>)</span><a class="self-link" href="#dictionary-user-credential-params"></a></h4>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity③">PublicKeyCredentialUserEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑥">user account</a> attributes when creating a new
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity③">PublicKeyCredentialUserEntity</a></code> dictionary is used to supply additional <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user account</a> attributes when creating a new
 credential.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity④"><c- g>PublicKeyCredentialUserEntity</c-></a> : <a data-link-type="idl-name" href="#dictdef-publickeycredentialentity" id="ref-for-dictdef-publickeycredentialentity④"><c- n>PublicKeyCredentialEntity</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource④"><c- n>BufferSource</c-></a>   <a class="idl-code" data-link-type="dict-member" data-type="BufferSource   " href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑥"><c- g>id</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①④"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname④"><c- g>displayName</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③①"><c- b>DOMString</c-></a>      <a class="idl-code" data-link-type="dict-member" data-type="DOMString      " href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤"><c- g>displayName</c-></a>;
 };
 </pre>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑤">BufferSource</a></span>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①①">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑦">user account</a>.
+      <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①①">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑨">user account</a>.
 A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①②">user handle</a> is an opaque <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#byte-sequence" id="ref-for-byte-sequence②">byte sequence</a> with a maximum size of 64 bytes,
 and is not meant to be displayed to the user.</p>
       <p>To ensure secure operation, authentication and authorization
-decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑤">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①⓪">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a>.</p>
+decisions MUST be made on the basis of this <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑦">id</a></code> member,  not the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑥">displayName</a></code> nor <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code> members. See Section 6.1 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a>.</p>
       <p>The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①③">user handle</a> MUST NOT contain personally identifying information about the user, such as a username or e-mail address;
 see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a> for details. The <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①④">user handle</a> MUST NOT be empty.</p>
-      <p class="note" role="note"><span>Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑤">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑧">user accounts</a>,
+      <p class="note" role="note"><span>Note:</span> the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑤">user handle</a> <i>ought not</i> be a constant value across different <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⓪">user accounts</a>,
 even for <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential②">non-discoverable credentials</a>, because some authenticators always create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑤">discoverable credentials</a>.
 Thus a constant <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑥">user handle</a> would prevent a user from using such an authenticator
-with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account①⑨">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①①⑨">Relying Party</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑤">DOMString</a></span>
+with more than one <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user account</a> at the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialUserEntity" data-dfn-type="dict-member" data-export id="dom-publickeycredentialuserentity-displayname"><code>displayName</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a></span>
      <dd data-md>
-      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⓪">user account</a>, intended only for display. For example, "Alex Müller" or "田中倫". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⓪">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.</p>
+      <p>A <a data-link-type="dfn" href="#human-palatability" id="ref-for-human-palatability④">human-palatable</a> name for the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a>, intended only for display. For example, "Alex Müller" or "田中倫". The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> SHOULD let the user choose this, and SHOULD NOT restrict the choice more than necessary.</p>
       <ul>
        <li data-md>
-        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②①">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
-when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑥">displayName</a></code>'s value, or displaying the value to the user.</p>
+        <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Parties</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
+when setting <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value, or displaying the value to the user.</p>
        <li data-md>
-        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②②">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
+        <p>This string MAY contain language and direction metadata. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Parties</a> SHOULD consider providing this information. See <a href="#sctn-strings-langdir">§ 6.4.2 Language and Direction Encoding</a> about how this metadata is encoded.</p>
        <li data-md>
-        <p><a data-link-type="dfn" href="#client" id="ref-for-client③③">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
-on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑦">displayName</a></code>'s value prior to displaying the value to the user or
+        <p><a data-link-type="dfn" href="#client" id="ref-for-client④①">Clients</a> SHOULD perform enforcement, as prescribed in Section 2.3 of <a data-link-type="biblio" href="#biblio-rfc8266">[RFC8266]</a> for the Nickname Profile of the PRECIS FreeformClass <a data-link-type="biblio" href="#biblio-rfc8264">[RFC8264]</a>,
+on <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value prior to displaying the value to the user or
 including the value as a parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential⑨">authenticatorMakeCredential</a> operation.</p>
       </ul>
-      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client③④">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③①">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑧">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑧">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3">[css-overflow-3]</a>.</p>
-      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator⑨⑨">Authenticators</a> MUST accept and store a 64-byte minimum length for a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code> member’s value. Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value so that it fits within 64 bytes. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
+      <p>When <a data-link-type="dfn" href="#client" id="ref-for-client④②">clients</a>, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a>, or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticators</a> display a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname⑨">displayName</a></code>'s value, they should always use UI elements to provide a clear boundary around the displayed value, and not allow overflow into other elements <a data-link-type="biblio" href="#biblio-css-overflow-3">[css-overflow-3]</a>.</p>
+      <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">Authenticators</a> MUST accept and store a 64-byte minimum length for a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①⓪">displayName</a></code> member’s value. Authenticators MAY truncate a <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code> member’s value so that it fits within 64 bytes. See <a href="#sctn-strings-truncation">§ 6.4.1 String Truncation</a> about truncation and other considerations.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.4" id="dictionary-authenticatorSelection"><span class="secno">5.4.4. </span><span class="content">Authenticator Selection Criteria (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticatorselectioncriteria"><code>AuthenticatorSelectionCriteria</code></dfn>)</span><a class="self-link" href="#dictionary-authenticatorSelection"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑦">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria②">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Parties</a> may use the <code class="idl"><a data-link-type="idl" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③">AuthenticatorSelectionCriteria</a></code> dictionary to specify their requirements regarding authenticator
 attributes.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria③"><c- g>AuthenticatorSelectionCriteria</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑥"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment①"><c- g>authenticatorAttachment</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑦"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②"><c- g>residentKey</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①"><c- b>boolean</c-></a>                      <a class="idl-code" data-default="false" data-link-type="dict-member" data-type="boolean                      " href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey②"><c- g>requireResidentKey</c-></a> = <c- b>false</c->;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑧"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③"><c- g>userVerification</c-></a> = "preferred";
+<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticatorselectioncriteria" id="ref-for-dictdef-authenticatorselectioncriteria④"><c- g>AuthenticatorSelectionCriteria</c-></a> {
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③③"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-authenticatorattachment" id="ref-for-dom-authenticatorselectioncriteria-authenticatorattachment①"><c- g>authenticatorAttachment</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey②"><c- g>residentKey</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②"><c- b>boolean</c-></a>                      <a class="idl-code" data-default="false" data-link-type="dict-member" data-type="boolean                      " href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey②"><c- g>requireResidentKey</c-></a> = <c- b>false</c->;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤"><c- b>DOMString</c-></a>                    <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString                    " href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification③"><c- g>userVerification</c-></a> = "preferred";
 };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString①⑨">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-authenticatorattachment"><code>authenticatorAttachment</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑥">DOMString</a></span>
      <dd data-md>
-      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⓪">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
+      <p>If this member is present, eligible <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticators</a> are filtered to be only those authenticators attached with the specified <a href="#enum-attachment">authenticator attachment modality</a> (see also <a href="#sctn-authenticator-attachment-modality">§ 6.2.1 Authenticator Attachment Modality</a>).
 If this member is absent, then any attachment modality is acceptable.
-The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③②">client platforms</a> MUST ignore unknown values,
+The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment③">AuthenticatorAttachment</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a> MUST ignore unknown values,
 treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists①">member does not exist</a>.</p>
-      <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑤">PublicKeyCredential</a></code>,
+      <p>See also the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-authenticatorattachment" id="ref-for-dom-publickeycredential-authenticatorattachment④">authenticatorAttachment</a></code> member of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑨">PublicKeyCredential</a></code>,
 which can tell what <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑤">authenticator attachment modality</a> was used
-in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑤">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⓪">get()</a></code> operation.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⓪">DOMString</a></span>
+in a successful <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">get()</a></code> operation.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-residentkey"><code>residentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦">DOMString</a></span>
      <dd data-md>
-      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②③">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③③">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
+      <p>Specifies the extent to which the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> desires to create a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑥">client-side discoverable credential</a>. For historical reasons the naming retains the deprecated “resident” terminology. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement">ResidentKeyRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists②">member does not exist</a>. If no value is given then the effective value is <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required②">required</a></code> if <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey③">requireResidentKey</a></code> is <code>true</code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged②">discouraged</a></code> if it is <code>false</code> or absent.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement①">ResidentKeyRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey③">residentKey</a></code>'s values and semantics.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean②">boolean</a>, defaulting to <code>false</code></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-requireresidentkey"><code>requireResidentKey</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean③">boolean</a>, defaulting to <code>false</code></span>
      <dd data-md>
-      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②④">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②①">DOMString</a>, defaulting to <code>"preferred"</code></span>
+      <p>This member is retained for backwards compatibility with WebAuthn Level 1 and, for historical reasons, its naming retains the deprecated “resident” terminology for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑥">discoverable credentials</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Parties</a> SHOULD set it to <code>true</code> if, and only if, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey④">residentKey</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required③">required</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorSelectionCriteria" data-dfn-type="dict-member" data-export id="dom-authenticatorselectioncriteria-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑧">DOMString</a>, defaulting to <code>"preferred"</code></span>
      <dd data-md>
-      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑤">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑧">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑥">create()</a></code> operation.
-The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③④">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>.</p>
+      <p>This member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑧">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">create()</a></code> operation.
+The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists③">member does not exist</a>.</p>
       <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement①">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification④">userVerification</a></code>'s values and semantics.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class="secno">5.4.5. </span><span class="content">Authenticator Attachment Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatorattachment"><code>AuthenticatorAttachment</code></dfn>)</span><a class="self-link" href="#enum-attachment"></a></h4>
-   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪①">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑥">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑦">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client③⑤">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony④">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①①">authentication ceremony</a>.</p>
+   <p>This enumeration’s values describe <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticators</a>' <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑥">attachment modalities</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Parties</a> use this to express a preferred <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑦">authenticator attachment modality</a> when calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">navigator.credentials.create()</a></code> to <a href="#sctn-createCredential">create a credential</a>, and <a data-link-type="dfn" href="#client" id="ref-for-client④③">clients</a> use this to report the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑧">authenticator attachment modality</a> used to complete a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremony</a>.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-authenticatorattachment" id="ref-for-enumdef-authenticatorattachment④"><c- g>AuthenticatorAttachment</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-platform" id="ref-for-dom-authenticatorattachment-platform"><c- s>"platform"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatorattachment-cross-platform" id="ref-for-dom-authenticatorattachment-cross-platform"><c- s>"cross-platform"</c-></a>
@@ -3192,9 +3490,9 @@ <h4 class="heading settled" data-level="5.4.5" id="enum-attachment"><span class=
     </dl>
    </div>
    <p class="note" role="note"><span>Note:</span> An <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality⑨">authenticator attachment modality</a> selection option is available only in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot③">[[Create]](origin, options,
-sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑦">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
+sameOriginWithAncestors)</a></code> operation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> may use it to, for example, ensure the user has a <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential">roaming credential</a> for
 authenticating on another <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑥">client device</a>; or to specifically register a <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential">platform credential</a> for easier reauthentication using a
-particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑧">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③②">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client③⑥">client</a> and user will then use whichever is available and convenient at the time.</p>
+particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑦">client device</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operation has no <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①⓪">authenticator attachment modality</a> selection option, so the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a> SHOULD accept any of the user’s registered <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">credentials</a>. The <a data-link-type="dfn" href="#client" id="ref-for-client④④">client</a> and user will then use whichever is available and convenient at the time.</p>
    <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement"><span class="secno">5.4.6. </span><span class="content">Resident Key Requirement Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-residentkeyrequirement"><code>ResidentKeyRequirement</code></dfn>)</span><a class="self-link" href="#enum-residentKeyRequirement"></a></h4>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement②"><c- g>ResidentKeyRequirement</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged③"><c- s>"discouraged"</c-></a>,
@@ -3203,29 +3501,29 @@ <h4 class="heading settled" data-level="5.4.6" id="enum-residentKeyRequirement">
 };
 </pre>
    <p class="note" role="note"><span>Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-residentkeyrequirement" id="ref-for-enumdef-residentkeyrequirement③">ResidentKeyRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①②⑨">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
+   <p>This enumeration’s values describe the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a>'s requirements for <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑦">client-side discoverable credentials</a> (formerly known as <a data-link-type="dfn" href="#resident-credential" id="ref-for-resident-credential①">resident credentials</a> or <a data-link-type="dfn" href="#resident-key" id="ref-for-resident-key②">resident keys</a>):</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-residentkeyrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⓪">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client③⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪②">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
-      <p class="note" role="note"><span>Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③①">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> will evict the first.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Party</a> prefers creating a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑥">server-side credential</a>, but will accept a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑧">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑦">server-side credential</a> if possible.</p>
+      <p class="note" role="note"><span>Note:</span> A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a> cannot require that a created credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑧">server-side credential</a> and the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops①">Credential Properties Extension</a> may not return a value for the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk">rk</a></code> property. Because of this, it may be the case that it does not know if a credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential⑨">server-side credential</a> or not and thus does not know whether creating a second credential with the same <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑦">user handle</a> will evict the first.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-residentkeyrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③②">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client③⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪③">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credential</a> if possible.
-For example, the <a data-link-type="dfn" href="#client" id="ref-for-client③⑨">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> strongly prefers creating a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential⑨">client-side discoverable credential</a>, but will accept a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⓪">server-side credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticator</a> SHOULD create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑦">discoverable credential</a> if possible.
+For example, the <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a> SHOULD guide the user through setting up <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification①⑨">user verification</a> if needed to create a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑧">discoverable credential</a>. This takes precedence over the setting of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑤">userVerification</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="ResidentKeyRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-residentkeyrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③③">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⓪">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a> requires a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⓪">client-side discoverable credential</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> MUST return an error if a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①①">client-side discoverable credential</a> cannot be created.</p>
     </dl>
    </div>
-   <p class="note" role="note"><span>Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③④">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
-This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪④">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
+   <p class="note" role="note"><span>Note:</span> The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a> can seek information on whether or not the authenticator created a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①②">client-side discoverable credential</a> using the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a> of the <a data-link-type="dfn" href="#credprops" id="ref-for-credprops②">Credential Properties Extension</a>.
+This is useful when values of <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-discouraged" id="ref-for-dom-residentkeyrequirement-discouraged④">discouraged</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred③">preferred</a></code> are used for <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑤">residentKey</a></code></code>, because in those cases it is possible for an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticator</a> to create <em>either</em> a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①③">client-side discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①①">server-side credential</a>.</p>
    <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><span class="secno">5.4.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-conveyance">Attestation Conveyance</dfn> Preference Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-attestationconveyancepreference"><code>AttestationConveyancePreference</code></dfn>)</span><a class="self-link" href="#enum-attestation-convey"></a></h4>
-   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑧">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
+   <p><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Parties</a> may use <code class="idl"><a data-link-type="idl" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference①">AttestationConveyancePreference</a></code> to specify their preference regarding <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance②">attestation conveyance</a> during credential generation.</p>
 <pre class="idl highlight def"><c- b>enum</c-> <a class="idl-code" data-link-type="enum" href="#enumdef-attestationconveyancepreference" id="ref-for-enumdef-attestationconveyancepreference②"><c- g>AttestationConveyancePreference</c-></a> {
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none②"><c- s>"none"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-attestationconveyancepreference-indirect" id="ref-for-dom-attestationconveyancepreference-indirect①"><c- s>"indirect"</c-></a>,
@@ -3238,208 +3536,208 @@ <h4 class="heading settled" data-level="5.4.7" id="enum-attestation-convey"><spa
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;none&quot;|none" id="dom-attestationconveyancepreference-none"><code>none</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑤">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑤">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a>. For example, in order to
-potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑥">Relying Party</a>, or to save a
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Party</a> is not interested in <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticator</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑧">attestation</a>. For example, in order to
+potentially avoid having to obtain <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①②">user consent</a> to relay identifying information to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a>, or to save a
 roundtrip to an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca">Attestation CA</a> or <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca①">Anonymization CA</a>.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑥">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑦">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
-the <a data-link-type="dfn" href="#client" id="ref-for-client④①">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticator</a> generates an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a> that is not a <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑤">self attestation</a>,
+the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> will replace it with a <a data-link-type="dfn" href="#none" id="ref-for-none">None</a> attestation statement.</p>
       <p>This is the default, and unknown values fall back to the behavior of this value.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;indirect&quot;|indirect" id="dom-attestationconveyancepreference-indirect"><code>indirect</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑦">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑧">attestation statement</a>,
-but allows the <a data-link-type="dfn" href="#client" id="ref-for-client④②">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>.
-The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
-in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑧">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
-      <p class="note" role="note"><span>Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①③⑨">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> in this case.
-For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client④③">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> through unmodified.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a> wants to receive a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement⑨">attestation statement</a>,
+but allows the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> to decide how to obtain such an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⓪">attestation statement</a>.
+The client MAY replace an authenticator-generated <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①①">attestation statement</a> with one generated by an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca②">Anonymization CA</a>,
+in order to protect the user’s privacy, or to assist <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Parties</a> with attestation verification in a heterogeneous ecosystem.</p>
+      <p class="note" role="note"><span>Note:</span> There is no guarantee that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> will obtain a verifiable <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①②">attestation statement</a> in this case.
+For example, in the case that the authenticator employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑥">self attestation</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a> passes the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> through unmodified.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;direct&quot;|direct" id="dom-attestationconveyancepreference-direct"><code>direct</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⓪">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①③">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑦">authenticator</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> wants to receive the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> as generated by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticator</a>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AttestationConveyancePreference" data-dfn-type="enum-value" data-export data-lt="&quot;enterprise&quot;|enterprise" id="dom-attestationconveyancepreference-enterprise"><code>enterprise</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④①">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①④">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②③">RP ID</a>.</p>
-      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑤">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④②">Relying Party</a>.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a> wants to receive an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑤">attestation statement</a> that may include uniquely identifying information. This is intended for controlled deployments within an enterprise where the organization wishes to tie registrations to specific authenticators. User agents MUST NOT provide such an attestation unless the user agent or authenticator configuration permits it for the requested <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a>.</p>
+      <p>If permitted, the user agent SHOULD signal to the authenticator (at <a href="#CreateCred-InvokeAuthnrMakeCred">invocation time</a>) that enterprise attestation is requested, and convey the resulting <a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑤">AAGUID</a> and <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a>, unaltered, to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a>.</p>
     </dl>
    </div>
    <h3 class="heading settled" data-level="5.5" id="dictionary-assertion-options"><span class="secno">5.5. </span><span class="content">Options for Assertion Generation (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialrequestoptions"><code>PublicKeyCredentialRequestOptions</code></dfn>)</span><a class="self-link" href="#dictionary-assertion-options"></a></h3>
-   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions②">PublicKeyCredentialRequestOptions</a></code> dictionary supplies <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②①">get()</a></code> with the data it needs to generate
+   <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑧">PublicKeyCredentialRequestOptions</a></code> dictionary supplies <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②②">get()</a></code> with the data it needs to generate
 an assertion. Its <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge①">challenge</a></code> member MUST be present, while its other members are OPTIONAL.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions③"><c- g>PublicKeyCredentialRequestOptions</c-></a> {
+<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑨"><c- g>PublicKeyCredentialRequestOptions</c-></a> {
     <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑥"><c- n>BufferSource</c-></a>                <a class="idl-code" data-link-type="dict-member" data-type="BufferSource                " href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge②"><c- g>challenge</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long②"><c- b>unsigned</c-> <c- b>long</c-></a>                        <a class="idl-code" data-link-type="dict-member" data-type="unsigned long                        " href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout③"><c- g>timeout</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long④"><c- b>unsigned</c-> <c- b>long</c-></a>                        <a class="idl-code" data-link-type="dict-member" data-type="unsigned long                        " href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout③"><c- g>timeout</c-></a>;
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString"><c- b>USVString</c-></a>                            <a class="idl-code" data-link-type="dict-member" data-type="USVString                            " href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid④"><c- g>rpId</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence③"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑤"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor> " href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①①"><c- g>allowCredentials</c-></a> = [];
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②②"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString                            " href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③"><c- g>userVerification</c-></a> = "preferred";
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑧"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑦"><c- n>PublicKeyCredentialDescriptor</c-></a>> <a class="idl-code" data-default="[]" data-link-type="dict-member" data-type="sequence<PublicKeyCredentialDescriptor> " href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③"><c- g>allowCredentials</c-></a> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨"><c- b>DOMString</c-></a>                            <a class="idl-code" data-default="&quot;preferred&quot;" data-link-type="dict-member" data-type="DOMString                            " href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification③"><c- g>userVerification</c-></a> = "preferred";
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs②"><c- n>AuthenticationExtensionsClientInputs</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsClientInputs " href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions③"><c- g>extensions</c-></a>;
 };
 </pre>
    <dl>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑦">BufferSource</a></span>
     <dd data-md>
-     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑧">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long③">unsigned long</a></span>
+     <p>This member specifies a challenge that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> signs, along with other data, when producing an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①②">authentication assertion</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-timeout"><code>timeout</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑤">unsigned long</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④③">Relying Party</a> is willing to wait for the call to complete.
-The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client④④">client</a>.</p>
+     <p>This OPTIONAL member specifies a time, in milliseconds, that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> is willing to wait for the call to complete.
+The value is treated as a hint, and MAY be overridden by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a>.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-rpid"><code>rpId</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString①">USVString</a></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②④">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④④">Relying Party</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client④⑤">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑤">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⓪⑨">authenticator</a> MUST verify
-that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①①">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①②">authentication ceremony</a>.</p>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑤">RP ID</a> claimed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> MUST verify that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①①">origin</a> matches the <a data-link-type="dfn" href="#scope" id="ref-for-scope①②">scope</a> of this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑥">RP ID</a>.
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a> MUST verify
+that this <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> exactly equals the <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid">rpId</a> of the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credential</a> to be used for the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremony</a>.</p>
      <p>If not specified, its value will
 be the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer②">CredentialsContainer</a></code> object’s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#relevant-settings-object" id="ref-for-relevant-settings-object④">relevant settings object</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#concept-settings-object-origin" id="ref-for-concept-settings-object-origin⑦">origin</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin-effective-domain" id="ref-for-concept-origin-effective-domain①③">effective domain</a>.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑥">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-allowcredentials"><code>allowCredentials</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a>>, defaulting to <code>[]</code></span>
     <dd data-md>
-     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑥">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⓪">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①③">authentication ceremony</a>.
+     <p>This OPTIONAL member is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">client</a> to find <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticators</a> eligible for this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremony</a>.
 It can be used in two ways:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②①">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑥">Relying Party</a> SHOULD use this member to list the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①②">credentials</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑤">registered</a> to the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②②">user account</a>.
-This SHOULD usually include all of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account’s</a> credentials.</p>
-       <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑥">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑧">transports</a></code> whenever possible.
-This helps the <a data-link-type="dfn" href="#client" id="ref-for-client④⑦">client</a> optimize the user experience for any given situation.
-Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑦">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⓪">user verification</a> —
-the <a data-link-type="dfn" href="#client" id="ref-for-client④⑧">client</a> will automatically ignore non-eligible credentials
+       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②③">user account</a> to authenticate is already identified (e.g., if the user has entered a username),
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a> SHOULD use this member to list <a data-link-type="dfn" href="#credential-descriptor-for-a-credential-record" id="ref-for-credential-descriptor-for-a-credential-record">credential descriptors for credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a>.
+This SHOULD usually include all <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑤">credential records</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a>.</p>
+       <p>The <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">items</a> SHOULD specify <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨">transports</a></code> whenever possible.
+This helps the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> optimize the user experience for any given situation.
+Also note that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a> does not need to filter the list when requesting <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⓪">user verification</a> —
+the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> will automatically ignore non-eligible credentials
 if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification④">userVerification</a></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑥">required</a></code>.</p>
        <p>See also the <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a> privacy consideration.</p>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②④">user account</a> to authenticate is not already identified,
-then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑧">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty①">empty</a> or unspecified.
-In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①④">authentication ceremony</a>,
-and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑤">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code>.
-If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①①">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①④⑨">Relying Party</a>,
-the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑤">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①②">authenticator</a> for the user to select from (see step 7 of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
+       <p>If the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a> to authenticate is not already identified,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a> MAY leave this member <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty③">empty</a> or unspecified.
+In this case, only <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential⑨">discoverable credentials</a> will be utilized in this <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication ceremony</a>,
+and the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> MAY be identified by the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑤">userHandle</a></code> of the resulting <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑤">AuthenticatorAssertionResponse</a></code>.
+If the available <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticators</a> <a data-link-type="dfn" href="#contains" id="ref-for-contains②">contain</a> more than one <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⓪">discoverable credential</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope①③">scoped</a> to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a>,
+the credentials are displayed by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platform</a> or <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">authenticator</a> for the user to select from (see step 7 of <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>).</p>
      </ul>
-     <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty②">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
+     <p>If not <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a>, the client MUST return an error if none of the listed credentials can be used.</p>
      <p>The list is ordered in descending order of preference: the first item in the list is the most
 preferred credential, and the last is the least preferred.</p>
-    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②③">DOMString</a>, defaulting to <code>"preferred"</code></span>
+    <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-userverification"><code>userVerification</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⓪">DOMString</a>, defaulting to <code>"preferred"</code></span>
     <dd data-md>
-     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⓪">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②②">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑥">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
+     <p>This OPTIONAL member specifies the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a>'s requirements regarding <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②①">user verification</a> for the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> operation. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement②">UserVerificationRequirement</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists④">member does not exist</a>. Eligible authenticators are filtered to only those capable of satisfying this requirement.</p>
      <p>See <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement③">UserVerificationRequirement</a></code> for the description of <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-userverification" id="ref-for-dom-authenticatorselectioncriteria-userverification⑥">userVerification</a></code>'s values and semantics.</p>
     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialRequestOptions" data-dfn-type="dict-member" data-export id="dom-publickeycredentialrequestoptions-extensions"><code>extensions</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs③">AuthenticationExtensionsClientInputs</a></span>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤①">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client④⑨">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①③">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> MAY use this OPTIONAL member to provide <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client extension inputs</a> requesting additional processing by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a>.</p>
      <p>The extensions framework is defined in <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a>.
 Some extensions are defined in <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>;
 consult the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a> for an up-to-date list
-of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①">WebAuthn Extensions</a>.</p>
+of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn Extensions</a>.</p>
    </dl>
    <h3 class="heading settled" data-level="5.6" id="sctn-abortoperation"><span class="secno">5.6. </span><span class="content">Abort Operations with <code>AbortSignal</code></span><a class="self-link" href="#sctn-abortoperation"></a></h3>
-   <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
+   <p>Developers are encouraged to leverage the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller②">AbortController</a></code> to manage the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot④">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations.
 See <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section for detailed instructions.</p>
    <p class="note" role="note"><span>Note:</span> <a href="https://dom.spec.whatwg.org/#abortcontroller-api-integration"><cite>DOM</cite> § 3.3 Using AbortController and AbortSignal objects in APIs</a> section specifies that web platform APIs integrating with the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortcontroller" id="ref-for-abortcontroller③">AbortController</a></code> must reject the promise immediately once the <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#abortsignal" id="ref-for-abortsignal">AbortSignal</a></code> is <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted④">aborted</a>.
-    Given the complex inheritance and parallelization structure of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑤">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> methods, the algorithms for the two APIs fulfills this
-    requirement by checking the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑤">aborted</a> property in three places. In the case of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑥">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑥">aborted</a> property is checked first in <a href="https://www.w3.org/TR/credential-management-1/#algorithm-create"><cite>Credential Management 1</cite> § 2.5.4 Create a Credential</a> immediately before calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#create-origin-options-sameoriginwithancestors" id="ref-for-create-origin-options-sameoriginwithancestors">[[Create]](origin, options, sameOriginWithAncestors)</a></code>,
+    Given the complex inheritance and parallelization structure of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑤">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> methods, the algorithms for the two APIs fulfills this
+    requirement by checking the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑤">aborted</a> property in three places. In the case of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑥">[[Create]](origin, options, sameOriginWithAncestors)</a></code>, the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#abortsignal-aborted" id="ref-for-abortsignal-aborted⑥">aborted</a> property is checked first in <a href="https://w3c.github.io/webappsec-credential-management/#algorithm-create"><cite>Credential Management 1</cite> § 2.5.4 Create a Credential</a> immediately before calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#create-origin-options-sameoriginwithancestors" id="ref-for-create-origin-options-sameoriginwithancestors">[[Create]](origin, options, sameOriginWithAncestors)</a></code>,
     then in <a href="#sctn-createCredential">§ 5.1.3 Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> right before <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session">authenticator sessions</a> start, and finally
-    during <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session①">authenticator sessions</a>. The same goes for <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>.</p>
-   <p>The <a data-link-type="dfn" href="https://www.w3.org/TR/page-visibility/#visibility-states" id="ref-for-visibility-states">visibility</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/#focus" id="ref-for-focus">focus</a> state of the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-window" id="ref-for-concept-request-window">Window</a> object determines whether the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑦">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
-should continue. When the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-window" id="ref-for-concept-request-window①">Window</a> object associated with the [<a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document" id="ref-for-concept-document">Document</a> loses focus, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑧">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑧">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
+    during <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session①">authenticator sessions</a>. The same goes for <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑧">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code>.</p>
+   <p>The <a data-link-type="dfn" href="https://www.w3.org/TR/page-visibility/#visibility-states" id="ref-for-visibility-states">visibility</a> and <a data-link-type="dfn" href="https://html.spec.whatwg.org/#focus" id="ref-for-focus">focus</a> state of the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-window" id="ref-for-concept-request-window">Window</a> object determines whether the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑦">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑨">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
+should continue. When the <a data-link-type="dfn" href="https://fetch.spec.whatwg.org/#concept-request-window" id="ref-for-concept-request-window①">Window</a> object associated with the <a data-link-type="dfn" href="https://dom.spec.whatwg.org/#concept-document" id="ref-for-concept-document①">Document</a> loses focus, <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑧">[[Create]](origin, options, sameOriginWithAncestors)</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⓪">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> operations
 SHOULD be aborted.</p>
    <p class="issue" id="issue-c0359d2a"><a class="self-link" href="#issue-c0359d2a"></a> The WHATWG HTML WG is discussing whether to provide a hook when a browsing context gains or
     loses focuses. If a hook is provided, the above paragraph will be updated to include the hook.
     See <a href="https://github.com/whatwg/html/issues/2711">WHATWG HTML WG Issue #2711</a> for more details.</p>
    <h3 class="heading settled" data-level="5.7" id="sctn-extensions-inputs-outputs"><span class="secno">5.7. </span><span class="content">WebAuthn Extensions Inputs and Outputs</span><a class="self-link" href="#sctn-extensions-inputs-outputs"></a></h3>
-   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions②">WebAuthn extension</a> inputs and outputs.</p>
-   <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output">Authenticator extension outputs</a> are conveyed as a part of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①③">Authenticator data</a> (see <a href="#table-authData">Table 1</a>).</p>
+   <p>The subsections below define the data types used for conveying <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn extension</a> inputs and outputs.</p>
+   <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output">Authenticator extension outputs</a> are conveyed as a part of <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑤">Authenticator data</a> (see <a href="#table-authData">Table 1</a>).</p>
    <p class="note" role="note"><span>Note:</span> The types defined below — <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs④">AuthenticationExtensionsClientInputs</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs③">AuthenticationExtensionsClientOutputs</a></code> — are applicable to both <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①">authentication extensions</a>. The "Authentication..." portion of their names should be regarded as meaning "WebAuthentication..."</p>
    <h4 class="heading settled" data-level="5.7.1" id="iface-authentication-extensions-client-inputs"><span class="secno">5.7.1. </span><span class="content">Authentication Extensions Client Inputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑤">AuthenticationExtensionsClientInputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-inputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientinputs"><code><c- g>AuthenticationExtensionsClientInputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input②">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions③">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.2" id="iface-authentication-extensions-client-outputs"><span class="secno">5.7.2. </span><span class="content">Authentication Extensions Client Outputs (dictionary <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs④">AuthenticationExtensionsClientOutputs</a></code>)</span><a class="self-link" href="#iface-authentication-extensions-client-outputs"></a></h4>
 <pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsclientoutputs"><code><c- g>AuthenticationExtensionsClientOutputs</c-></code></dfn> {
 };
 </pre>
-   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions④">WebAuthn Extensions</a>.</p>
+   <p>This is a dictionary containing the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑤">client extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn Extensions</a>.</p>
    <h4 class="heading settled" data-level="5.7.3" id="iface-authentication-extensions-authenticator-inputs"><span class="secno">5.7.3. </span><span class="content">Authentication Extensions Authenticator Inputs (CDDL type <code>AuthenticationExtensionsAuthenticatorInputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-inputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorInputs = {
   * $$extensionInput .within ( tstr => any )
 }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorInputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑤">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑤">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input">authenticator extension input</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
-   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤②">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①④">authenticator</a>.</p>
+   <p>This type is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a>, but is used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a>.</p>
    <h4 class="heading settled" data-level="5.7.4" id="iface-authentication-extensions-authenticator-outputs"><span class="secno">5.7.4. </span><span class="content">Authentication Extensions Authenticator Outputs (CDDL type <code>AuthenticationExtensionsAuthenticatorOutputs</code>)</span><a class="self-link" href="#iface-authentication-extensions-authenticator-outputs"></a></h4>
 <pre>AuthenticationExtensionsAuthenticatorOutputs = {
   * $$extensionOutput .within ( tstr => any )
 }
 </pre>
    <p>The <a data-link-type="dfn" href="#cddl" id="ref-for-cddl①">CDDL</a> type <code>AuthenticationExtensionsAuthenticatorOutputs</code> defines a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑥">CBOR</a> map
-containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑥">WebAuthn Extensions</a>.
+containing the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①">authenticator extension output</a> values for zero or more <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a>.
 Extensions can add members as described in <a href="#sctn-extension-request-parameters">§ 9.3 Extending Request Parameters</a>.</p>
    <h3 class="heading settled" data-level="5.8" id="sctn-supporting-data-structures"><span class="secno">5.8. </span><span class="content">Supporting Data Structures</span><a class="self-link" href="#sctn-supporting-data-structures"></a></h3>
-   <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③③">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
+   <p>The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a> type uses certain data structures that are specified in supporting specifications. These are as
 follows.</p>
    <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span class="secno">5.8.1. </span><span class="content">Client Data Used in <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature">WebAuthn Signatures</a> (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-collectedclientdata"><code>CollectedClientData</code></dfn>)</span><a class="self-link" href="#dictionary-client-data"></a></h4>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party①⑨">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤①">client</a>. It is a key-value
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-data">client data</dfn> represents the contextual bindings of both the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Party</a> and the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a>. It is a key-value
 mapping whose keys are strings. Values can be any type that has a valid encoding in JSON. Its structure is defined by the
 following Web IDL.</p>
    <p class="note" role="note"><span>Note:</span> The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata②">CollectedClientData</a></code> may be extended in the future. Therefore it’s critical when parsing to be tolerant of unknown keys and of any reordering of the keys. See also <a href="#clientdatajson-verification">§ 5.8.1.2 Limited Verification Algorithm</a>.</p>
 <pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata③"><c- g>CollectedClientData</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②④"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type②"><c- g>type</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑤"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑥"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean③"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean                      " href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin②"><c- g>crossOrigin</c-></a>;        
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④①"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④②"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge②"><c- g>challenge</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④③"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin②"><c- g>origin</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean                      " href="#dom-collectedclientdata-crossorigin" id="ref-for-dom-collectedclientdata-crossorigin②"><c- g>crossOrigin</c-></a>;
 };
 
 <c- b>dictionary</c-> <dfn class="idl-code" data-dfn-type="dictionary" data-export id="dictdef-tokenbinding"><code><c- g>TokenBinding</c-></code><a class="self-link" href="#dictdef-tokenbinding"></a></dfn> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑦"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status"><c- g>status</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑧"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id"><c- g>id</c-></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④④"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status"><c- g>status</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑤"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id"><c- g>id</c-></a>;
 };
 
 <c- b>enum</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-tokenbindingstatus"><code><c- g>TokenBindingStatus</c-></code></dfn> { <a class="idl-code" data-link-type="enum-value" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present"><c- s>"present"</c-></a>, <a class="idl-code" data-link-type="enum-value" href="#dom-tokenbindingstatus-supported" id="ref-for-dom-tokenbindingstatus-supported"><c- s>"supported"</c-></a> };
 </pre>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString②⑨">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑥">DOMString</a></span>
      <dd data-md>
       <p>This member contains the string "webauthn.create" when creating new credentials, and "webauthn.get" when getting an
 assertion from an existing credential. The purpose of this member is to prevent certain types of signature confusion
 attacks (where an attacker substitutes one legitimate signature for another).</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⓪">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-challenge"><code>challenge</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑦">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤③">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③①">DOMString</a></span>
+      <p>This member contains the base64url encoding of the challenge provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a>. See the <a href="#sctn-cryptographic-challenges">§ 13.4.3 Cryptographic Challenges</a> security consideration.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-origin"><code>origin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑧">DOMString</a></span>
      <dd data-md>
       <p>This member contains the fully qualified <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①②">origin</a> of the requester, as provided to the authenticator by the client, in
 the syntax defined by <a data-link-type="biblio" href="#biblio-rfc6454">[RFC6454]</a>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-crossorigin"><code>crossOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean④">boolean</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CollectedClientData" data-dfn-type="dict-member" data-export id="dom-collectedclientdata-crossorigin"><code>crossOrigin</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑤">boolean</a></span>
      <dd data-md>
       <p>This OPTIONAL member contains the inverse of the <code>sameOriginWithAncestors</code> argument value
 that was passed into the <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑥">internal method</a>.</p>
      <dt data-md>[RESERVED] <dfn data-dfn-for="CollectedClientData" data-dfn-type="dfn" data-noexport id="collectedclientdata-tokenbinding">tokenBinding<a class="self-link" href="#collectedclientdata-tokenbinding"></a></dfn>
      <dd data-md>
       <p>This OPTIONAL member contains information about the state of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1">Token Binding</a> protocol <a data-link-type="biblio" href="#biblio-tokenbinding">[TokenBinding]</a> used when communicating
-with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤④">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
+with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a>. Its absence indicates that the client doesn’t support token binding</p>
       <p class="note" role="note"><span>Note:</span> While <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-1" id="ref-for-section-1①">Token Binding</a> was present in Level 1 and Level 2 of WebAuthn, its use is not expected in Level 3. The <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding">tokenBinding</a></code> field is reserved so that it will not be reused for a different purpose.</p>
       <div>
        <dl>
-        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③②">DOMString</a></span>
+        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-status"><code>status</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString④⑨">DOMString</a></span>
         <dd data-md>
-         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑦">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. When known, this member is one of the following:</p>
+         <p>This member SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus">TokenBindingStatus</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore unknown values, treating an unknown value as if the <code class="idl"><a data-link-type="idl" href="https://www.w3.org/TR/webauthn/#dom-collectedclientdata-tokenbinding" id="ref-for-dom-collectedclientdata-tokenbinding①">tokenBinding</a></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑤">member does not exist</a>. When known, this member is one of the following:</p>
          <div>
           <dl>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;supported&quot;|supported" id="dom-tokenbindingstatus-supported"><code>supported</code></dfn>
            <dd data-md>
-            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑤">Relying Party</a>.</p>
+            <p>Indicates the client supports token binding, but it was not negotiated when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a>.</p>
            <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBindingStatus" data-dfn-type="enum-value" data-export data-lt="&quot;present&quot;|present" id="dom-tokenbindingstatus-present"><code>present</code></dfn>
            <dd data-md>
-            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑥">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
+            <p>Indicates token binding was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Party</a>. In this case, the <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-id" id="ref-for-dom-tokenbinding-id①">id</a></code> member MUST be present.</p>
           </dl>
          </div>
          <p class="note" role="note"><span>Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-tokenbindingstatus" id="ref-for-enumdef-tokenbindingstatus①">TokenBindingStatus</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
-        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③③">DOMString</a></span>
+        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="TokenBinding" data-dfn-type="dict-member" data-export id="dom-tokenbinding-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⓪">DOMString</a></span>
         <dd data-md>
-         <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑤">base64url
-encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑦">Relying Party</a>.</p>
+         <p>This member MUST be present if <code class="idl"><a data-link-type="idl" href="#dom-tokenbinding-status" id="ref-for-dom-tokenbinding-status①">status</a></code> is <code class="idl"><a data-link-type="idl" href="#dom-tokenbindingstatus-present" id="ref-for-dom-tokenbindingstatus-present①">present</a></code>, and MUST be a <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪">base64url
+encoding</a> of the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2">Token Binding ID</a> that was used when communicating with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Party</a>.</p>
        </dl>
       </div>
-      <p class="note" role="note"><span>Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑧">client platform</a>-specific operation.</p>
+      <p class="note" role="note"><span>Note:</span> Obtaining a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8471#section-3.2" id="ref-for-section-3.2①">Token Binding ID</a> is a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platform</a>-specific operation.</p>
     </dl>
     <p>The <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata④">CollectedClientData</a></code> structure is used by the client to compute the following quantities:</p>
     <dl>
@@ -3452,7 +3750,7 @@ <h4 class="heading settled" data-level="5.8.1" id="dictionary-client-data"><span
     </dl>
    </div>
    <h5 class="heading settled" data-level="5.8.1.1" id="clientdatajson-serialization"><span class="secno">5.8.1.1. </span><span class="content">Serialization</span><a class="self-link" href="#clientdatajson-serialization"></a></h5>
-   <p>The serialization of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑥">CollectedClientData</a></code> is a subset of the algorithm for <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes" id="ref-for-serialize-a-javascript-value-to-json-bytes">JSON-serializing to bytes</a>. I.e. it produces a valid JSON encoding of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑦">CollectedClientData</a></code> but also provides additional structure that may be exploited by verifiers to avoid integrating a full JSON parser. While verifiers are recommended to perform standard JSON parsing, they may use the <a href="#clientdatajson-verification">more limited algorithm</a> below in contexts where a full JSON parser is too large. This verification algorithm requires only <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑥">base64url encoding</a>, appending of bytestrings (which could be implemented by writing into a fixed template), and three conditional checks (assuming that inputs are known not to need escaping).</p>
+   <p>The serialization of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑥">CollectedClientData</a></code> is a subset of the algorithm for <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#serialize-a-javascript-value-to-json-bytes" id="ref-for-serialize-a-javascript-value-to-json-bytes">JSON-serializing to bytes</a>. I.e. it produces a valid JSON encoding of the <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata⑦">CollectedClientData</a></code> but also provides additional structure that may be exploited by verifiers to avoid integrating a full JSON parser. While verifiers are recommended to perform standard JSON parsing, they may use the <a href="#clientdatajson-verification">more limited algorithm</a> below in contexts where a full JSON parser is too large. This verification algorithm requires only <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①①">base64url encoding</a>, appending of bytestrings (which could be implemented by writing into a fixed template), and three conditional checks (assuming that inputs are known not to need escaping).</p>
    <p>The serialization algorithm works by appending successive byte strings to an, initially empty, partial result until the complete result is obtained.</p>
    <ol>
     <li data-md>
@@ -3542,11 +3840,11 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
      <p>The inputs to the algorithm are:</p>
      <ol>
       <li data-md>
-       <p>A bytestring, <var>clientDataJSON</var>, that contains <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑤">clientDataJSON</a></code> — the serialized <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①⓪">CollectedClientData</a></code> that is to be verified.</p>
+       <p>A bytestring, <var>clientDataJSON</var>, that contains <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑥">clientDataJSON</a></code> — the serialized <code class="idl"><a data-link-type="idl" href="#dictdef-collectedclientdata" id="ref-for-dictdef-collectedclientdata①⓪">CollectedClientData</a></code> that is to be verified.</p>
       <li data-md>
        <p>A string, <var>type</var>, that contains the expected <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-type" id="ref-for-dom-collectedclientdata-type⑤">type</a></code>.</p>
       <li data-md>
-       <p>A byte string, <var>challenge</var>, that contains the challenge byte string that was given in the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions④">PublicKeyCredentialRequestOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions③">PublicKeyCredentialCreationOptions</a></code>.</p>
+       <p>A byte string, <var>challenge</var>, that contains the challenge byte string that was given in the <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①⓪">PublicKeyCredentialRequestOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑦">PublicKeyCredentialCreationOptions</a></code>.</p>
       <li data-md>
        <p>A string, <var>origin</var>, that contains the expected <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑤">origin</a></code> that issued the request to the user agent.</p>
       <li data-md>
@@ -3561,7 +3859,7 @@ <h5 class="heading settled" data-level="5.8.1.2" id="clientdatajson-verification
     <li data-md>
      <p>Append 0x2c226368616c6c656e6765223a (<code>,"challenge":</code>) to <var>expected</var>.</p>
     <li data-md>
-     <p>Perform <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑦">base64url encoding</a> on <var>challenge</var> to produce a string, <var>challengeBase64</var>.</p>
+     <p>Perform <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①②">base64url encoding</a> on <var>challenge</var> to produce a string, <var>challengeBase64</var>.</p>
     <li data-md>
      <p>Append <a data-link-type="dfn" href="#ccdtostring" id="ref-for-ccdtostring④">CCDToString</a>(<var>challengeBase64</var>) to <var>expected</var>.</p>
     <li data-md>
@@ -3616,36 +3914,36 @@ <h4 class="heading settled" data-level="5.8.2" id="enum-credentialType"><span cl
     <p>Currently one credential type is defined, namely "<dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialType" data-dfn-type="enum-value" data-export data-lt="&quot;public-key&quot;|public-key" id="dom-publickeycredentialtype-public-key"><code>public-key</code></dfn>".</p>
    </div>
    <h4 class="heading settled" data-level="5.8.3" id="dictionary-credential-descriptor"><span class="secno">5.8.3. </span><span class="content">Credential Descriptor (dictionary <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-publickeycredentialdescriptor"><code>PublicKeyCredentialDescriptor</code></dfn>)</span><a class="self-link" href="#dictionary-credential-descriptor"></a></h4>
-<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑦"><c- g>PublicKeyCredentialDescriptor</c-></a> {
-    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③④"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type①"><c- g>type</c-></a>;
-    <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑧"><c- n>BufferSource</c-></a>                 <a class="idl-code" data-link-type="dict-member" data-type="BufferSource                 " href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①"><c- g>id</c-></a>;
-    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence④"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑤"><c- b>DOMString</c-></a>>                   <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>                   " href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports⑨"><c- g>transports</c-></a>;
+<pre class="idl highlight def"><c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑨"><c- g>PublicKeyCredentialDescriptor</c-></a> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤①"><c- b>DOMString</c-></a>                    <a class="idl-code" data-link-type="dict-member" data-type="DOMString                    " href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type②"><c- g>type</c-></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑧"><c- n>BufferSource</c-></a>                 <a class="idl-code" data-link-type="dict-member" data-type="BufferSource                 " href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id④"><c- g>id</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑨"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤②"><c- b>DOMString</c-></a>>                   <a class="idl-code" data-link-type="dict-member" data-type="sequence<DOMString>                   " href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①⓪"><c- g>transports</c-></a>;
 };
 </pre>
-   <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③④">public key credential</a>.
-It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑧">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑤">authenticator</a>,
-and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②③">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤②">client</a>.
-It mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑥">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code>.</p>
+   <p>This dictionary identifies a specific <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a>.
+It is used in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create①⑨">create()</a></code> to prevent creating duplicate credentials on the same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticator</a>,
+and in <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②④">get()</a></code> to determine if and how the credential can currently be reached by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a>.
+It mirrors some fields of the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⓪">PublicKeyCredential</a></code> object returned by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> and <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">get()</a></code>.</p>
    <div>
     <dl>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑥">DOMString</a></span>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-type"><code>type</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤③">DOMString</a></span>
      <dd data-md>
-      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑤">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform③⑨">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑧">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type②">type</a></code>.</p>
-      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑦">PublicKeyCredential</a></code>.</p>
+      <p>This member contains the type of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to. The value SHOULD be a member of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑦">PublicKeyCredentialType</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">client platforms</a> MUST ignore any <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> with an unknown <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code>.</p>
+      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type①">type</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code>.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-id"><code>id</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource⑨">BufferSource</a></span>
      <dd data-md>
-      <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②①">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑥">public key credential</a> the caller is referring to.</p>
-      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑧">PublicKeyCredential</a></code>.</p>
-     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑦">DOMString</a>></span>
+      <p>This member contains the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to.</p>
+      <p>This mirrors the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid①">rawId</a></code> field of <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code>.</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="PublicKeyCredentialDescriptor" data-dfn-type="dict-member" data-export id="dom-publickeycredentialdescriptor-transports"><code>transports</code></dfn>, <span> of type sequence&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤④">DOMString</a>></span>
      <dd data-md>
-      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑤③">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑦">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⓪">client platforms</a> MUST ignore unknown values.</p>
-      <p>This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports①">getTransports()</a></code></code> method
-of a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential①⑨">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⓪">create()</a></code> operation.
+      <p>This OPTIONAL member contains a hint as to how the <a data-link-type="dfn" href="#client" id="ref-for-client⑥①">client</a> might communicate with the <a data-link-type="dfn" href="#public-key-credential-source-managing-authenticator" id="ref-for-public-key-credential-source-managing-authenticator①①">managing authenticator</a> of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> the caller is referring to. The values SHOULD be members of <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport②">AuthenticatorTransport</a></code> but <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platforms</a> MUST ignore unknown values.</p>
+      <p>This mirrors the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response④">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code> method
+of a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②③">PublicKeyCredential</a></code> structure created by a <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code> operation.
 When <a href="#sctn-registering-a-new-credential">registering a new credential</a>,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑧">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports②">getTransports()</a></code>.
-When creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor⑨">PublicKeyCredentialDescriptor</a></code> for that credential,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑤⑨">Relying Party</a> SHOULD retrieve that stored value
-and set it as the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①⓪">transports</a></code> member.</p>
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Party</a> SHOULD store the value returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code>.
+When creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code> for that credential,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> SHOULD retrieve that stored value
+and set it as the value of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> member.</p>
     </dl>
    </div>
    <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="secno">5.8.4. </span><span class="content">Authenticator Transport Enumeration (enum <dfn class="dfn-paneled idl-code" data-dfn-type="enum" data-export id="enumdef-authenticatortransport"><code>AuthenticatorTransport</code></dfn>)</span><a class="self-link" href="#enum-transport"></a></h4>
@@ -3653,27 +3951,31 @@ <h4 class="heading settled" data-level="5.8.4" id="enum-transport"><span class="
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-usb" id="ref-for-dom-authenticatortransport-usb"><c- s>"usb"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-nfc" id="ref-for-dom-authenticatortransport-nfc"><c- s>"nfc"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-ble" id="ref-for-dom-authenticatortransport-ble"><c- s>"ble"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-hybrid" id="ref-for-dom-authenticatortransport-hybrid"><c- s>"hybrid"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-internal" id="ref-for-dom-authenticatortransport-internal①"><c- s>"internal"</c-></a>
 };
 </pre>
    <p class="note" role="note"><span>Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-authenticatortransport" id="ref-for-enumdef-authenticatortransport④">AuthenticatorTransport</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
-     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑥">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑤④">clients</a>. This enumeration
+     <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">Authenticators</a> may implement various <a href="#enum-transport">transports</a> for communicating with <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">clients</a>. This enumeration
     defines hints as to how clients might communicate with a particular authenticator in order to obtain an assertion for a
-    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⓪">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⓪">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑧">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports③">getTransports()</a></code>. 
+    specific credential. Note that these hints represent the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a>'s best belief as to how an authenticator may be reached. A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> will typically learn of the supported transports for a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> via <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code>. 
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;usb&quot;|usb" id="dom-authenticatortransport-usb"><code>usb</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑦">authenticator</a> can be contacted over removable USB.</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a> can be contacted over removable USB.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;nfc&quot;|nfc" id="dom-authenticatortransport-nfc"><code>nfc</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑧">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a> can be contacted over Near Field Communication (NFC).</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;ble&quot;|ble" id="dom-authenticatortransport-ble"><code>ble</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①①⑨">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a> can be contacted over Bluetooth Smart (Bluetooth Low Energy / BLE).</p>
+     <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;hybrid&quot;|hybrid" id="dom-authenticatortransport-hybrid"><code>hybrid</code></dfn>
+     <dd data-md>
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a> can be contacted using a combination of (often separate) data-transport and proximity mechanisms. This supports, for example, authentication on a desktop computer using a smartphone.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticatorTransport" data-dfn-type="enum-value" data-export data-lt="&quot;internal&quot;|internal" id="dom-authenticatortransport-internal"><code>internal</code></dfn>
      <dd data-md>
-      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⓪">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
+      <p>Indicates the respective <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a> is contacted using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑧">client device</a>-specific transport,
 i.e., it is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①③">platform authenticator</a>.
 These authenticators are not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device①⑨">client device</a>.</p>
     </dl>
@@ -3685,7 +3987,7 @@ <h4 class="heading settled" data-level="5.8.5" id="sctn-alg-identifier"><span cl
      A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier⑨">COSEAlgorithmIdentifier</a></code>'s value is a number identifying a cryptographic algorithm.
     The algorithm identifiers SHOULD be values registered in the IANA COSE Algorithms registry <a data-link-type="biblio" href="#biblio-iana-cose-algs-reg">[IANA-COSE-ALGS-REG]</a>,
     for instance, <code>-7</code> for "ES256" and <code>-257</code> for "RS256". 
-    <p>The COSE algorithms registry leaves degrees of freedom to be specified by other parameters in a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7">COSE key</a>. In order to promote interoperability, this specification makes the following additional guarantees of <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②①">credential public keys</a>:</p>
+    <p>The COSE algorithms registry leaves degrees of freedom to be specified by other parameters in a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7">COSE key</a>. In order to promote interoperability, this specification makes the following additional guarantees of <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②②">credential public keys</a>:</p>
     <ol>
      <li data-md>
       <p>Keys with algorithm ES256 (-7) MUST specify P-256 (1) as the <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-13.1.1" id="ref-for-section-13.1.1②">crv</a> parameter and MUST NOT use the compressed point form.</p>
@@ -3705,23 +4007,23 @@ <h4 class="heading settled" data-level="5.8.6" id="enum-userVerificationRequirem
     <a class="idl-code" data-link-type="enum-value" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged④"><c- s>"discouraged"</c-></a>
 };
 </pre>
-   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②①">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> for some of its operations but not for others, and may use this type to express its
+   <p>A <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a> may require <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②②">user verification</a> for some of its operations but not for others, and may use this type to express its
 needs.</p>
    <p class="note" role="note"><span>Note:</span> The <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑤">UserVerificationRequirement</a></code> enumeration is deliberately not referenced, see <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.</p>
    <div>
     <dl>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;required&quot;|required" id="dom-userverificationrequirement-required"><code>required</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥①">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony⑨">ceremony</a> if the
-response does not have the <a data-link-type="dfn" href="#uv" id="ref-for-uv">UV</a> <a data-link-type="dfn" href="#flags" id="ref-for-flags②">flag</a> set.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑤">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> cannot be performed.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②③">user verification</a> for the operation and will fail the overall <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremony</a> if the
+response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④">flag</a> set.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> MUST return an error if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②④">user verification</a> cannot be performed.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;preferred&quot;|preferred" id="dom-userverificationrequirement-preferred"><code>preferred</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥②">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> for the operation if possible, but will not fail the
-operation if the response does not have the <a data-link-type="dfn" href="#uv" id="ref-for-uv①">UV</a> <a data-link-type="dfn" href="#flags" id="ref-for-flags③">flag</a> set.</p>
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Party</a> prefers <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑤">user verification</a> for the operation if possible, but will not fail the
+operation if the response does not have the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑤">flag</a> set.</p>
      <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="UserVerificationRequirement" data-dfn-type="enum-value" data-export data-lt="&quot;discouraged&quot;|discouraged" id="dom-userverificationrequirement-discouraged"><code>discouraged</code></dfn>
      <dd data-md>
-      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥③">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> employed during the operation (e.g., in the
+      <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a> does not want <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑥">user verification</a> employed during the operation (e.g., in the
 interest of minimizing disruption to the user interaction flow).</p>
     </dl>
    </div>
@@ -3729,44 +4031,44 @@ <h3 class="heading settled" data-level="5.9" id="sctn-permissions-policy"><span
    <div class="mdn-anno wrapped after">
     <button class="mdn-anno-btn"><b class="less-than-two-engines-flag" title="This feature is in less than two current engines.">⚠</b><span>MDN</span></button>
     <div class="feature">
-     <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy/publickey-credentials-get" title="The HTTP Feature-Policy header publickey-credentials-get directive controls whether the current document is allowed to access the Web Authentication API to retrieve public-key credentials; i.e, via navigator.credentials.get({publicKey: ..., ...}).">Headers/Feature-Policy/publickey-credentials-get</a></p>
+     <p><a href="https://developer.mozilla.org/en-US/docs/Web/HTTP/Headers/Feature-Policy/publickey-credentials-get" title="The HTTP Feature-Policy header publickey-credentials-get directive controls whether the current document is allowed to access the Web Authentication API to retrieve public-key credentials; i.e., via navigator.credentials.get({publicKey: ..., ...}).">Headers/Feature-Policy/publickey-credentials-get</a></p>
      <p class="less-than-two-engines-text">In only one current engine.</p>
      <div class="support">
       <span class="firefox no"><span>Firefox</span><span>None</span></span><span class="safari no"><span>Safari</span><span>None</span></span><span class="chrome yes"><span>Chrome</span><span>84+</span></span>
       <hr>
       <span class="opera no"><span>Opera</span><span>None</span></span><span class="edge_blink yes"><span>Edge</span><span>84+</span></span>
       <hr>
-      <span class="edge no"><span>Edge (Legacy)</span><span>None</span></span><span class="ie no"><span>IE</span><span>None</span></span>
+      <span class="edge no"><span>Edge (Legacy)</span><span>?</span></span><span class="ie no"><span>IE</span><span>None</span></span>
       <hr>
-      <span class="firefox_android no"><span>Firefox for Android</span><span>None</span></span><span class="safari_ios no"><span>iOS Safari</span><span>None</span></span><span class="chrome_android yes"><span>Chrome for Android</span><span>84+</span></span><span class="webview_android yes"><span>Android WebView</span><span>84+</span></span><span class="samsunginternet_android yes"><span>Samsung Internet</span><span>14.0+</span></span><span class="opera_android no"><span>Opera Mobile</span><span>None</span></span>
+      <span class="firefox_android no"><span>Firefox for Android</span><span>?</span></span><span class="safari_ios no"><span>iOS Safari</span><span>?</span></span><span class="chrome_android no"><span>Chrome for Android</span><span>?</span></span><span class="webview_android no"><span>Android WebView</span><span>?</span></span><span class="samsunginternet_android no"><span>Samsung Internet</span><span>?</span></span><span class="opera_android no"><span>Opera Mobile</span><span>None</span></span>
      </div>
     </div>
    </div>
    <p>This specification defines one <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#policy-controlled-feature" id="ref-for-policy-controlled-feature">policy-controlled feature</a> identified by
 the feature-identifier token "<code><dfn class="dfn-paneled" data-dfn-type="dfn" data-export data-lt="publickey-credentials-get-feature" id="publickey-credentials-get-feature">publickey-credentials-get</dfn></code>".
 Its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-permissions-policy/#default-allowlist" id="ref-for-default-allowlist">default allowlist</a> is '<code>self</code>'. <a data-link-type="biblio" href="#biblio-permissions-policy">[Permissions-Policy]</a></p>
-   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑤">navigator.credentials.get({publicKey:..., ...})</a></code>.
+   <p>A <code class="idl"><a data-link-type="idl" href="https://dom.spec.whatwg.org/#document" id="ref-for-document">Document</a></code>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/dom.html#concept-document-permissions-policy" id="ref-for-concept-document-permissions-policy②">permissions policy</a> determines whether any content in that <a href="https://html.spec.whatwg.org/multipage/dom.html#documents">document</a> is <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use①">allowed to successfully invoke</a> the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①②">Web Authentication API</a>, i.e., via <code><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">navigator.credentials.get({publicKey:..., ...})</a></code>.
 If disabled in any document, no content in the document will be <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#allowed-to-use" id="ref-for-allowed-to-use②">allowed to use</a> the foregoing methods: attempting to do so will <a href="https://www.w3.org/2001/tag/doc/promises-guide#errors">return an error</a>.</p>
-   <p class="note" role="note"><span>Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑨">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑦">internal method</a> does not have such access since it is invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operation <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
+   <p class="note" role="note"><span>Note:</span> Algorithms specified in <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a> perform the actual permissions policy evaluation. This is because such policy evaluation needs to occur when there is access to the <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#current-settings-object" id="ref-for-current-settings-object">current settings object</a>. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> <a data-link-type="dfn" href="https://tc39.github.io/ecma262/#sec-object-internal-methods-and-internal-slots" id="ref-for-sec-object-internal-methods-and-internal-slots①⑦">internal method</a> does not have such access since it is invoked <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/infrastructure.html#in-parallel" id="ref-for-in-parallel">in parallel</a> by <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer" id="ref-for-credentialscontainer③">CredentialsContainer</a></code>'s <a data-link-type="abstract-op" href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential" id="ref-for-abstract-opdef-request-a-credential①">Request a <code>Credential</code></a> abstract operation <a data-link-type="biblio" href="#biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]</a>.</p>
    <h3 class="heading settled" data-level="5.10" id="sctn-iframe-guidance"><span class="secno">5.10. </span><span class="content">Using Web Authentication within <code>iframe</code> elements</span><a class="self-link" href="#sctn-iframe-guidance"></a></h3>
    <p>The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①③">Web Authentication API</a> is disabled by default in cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element①">iframe</a></code>s.
-To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⓪">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥④">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
+To override this default policy and indicate that a cross-origin <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element②">iframe</a></code> is allowed to invoke the <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①④">Web Authentication API</a>'s <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method, specify the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow">allow</a></code> attribute on the <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element③">iframe</a></code> element and include the <code><a data-link-type="dfn" href="#publickey-credentials-get-feature" id="ref-for-publickey-credentials-get-feature">publickey-credentials-get</a></code> feature-identifier token in the <code><a data-link-type="element-sub" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#attr-iframe-allow" id="ref-for-attr-iframe-allow①">allow</a></code> attribute’s value.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Parties</a> utilizing the WebAuthn API in an embedded context should review <a href="#sctn-seccons-visibility">§ 13.4.2 Visibility Considerations for Embedded Usage</a> regarding <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing">UI redressing</a> and its possible mitigations.</p>
    <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span class="secno">6. </span><span class="content">WebAuthn <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-model">Authenticator Model</dfn></span><a class="self-link" href="#sctn-authenticator-model"></a></h2>
    <p><a href="#sctn-api">The Web Authentication API</a> implies a specific abstract functional model for a <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator④">WebAuthn Authenticator</a>. This section
 describes that <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model②">authenticator model</a>.</p>
-   <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④①">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
-Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④②">client platform</a>, MUST be indistinguishable
+   <p><a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">Client platforms</a> MAY implement and expose this abstract model in any way desired. However, the behavior of the client’s Web
+Authentication API implementation, when operating on the authenticators supported by that <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">client platform</a>, MUST be indistinguishable
 from the behavior specified in <a href="#sctn-api">§ 5 Web Authentication API</a>.</p>
-   <p class="note" role="note"><span>Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑥">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys, in section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses" id="ref-for-responses">§6.2. Responses</a>.</p>
+   <p class="note" role="note"><span>Note:</span> <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> is an example of a concrete instantiation of this model, but it is one in which there are differences in the data it returns and those expected by the <a href="#sctn-api">WebAuthn API</a>'s algorithms. The CTAP2 response messages are CBOR maps constructed using integer keys rather than the string keys defined in this specification for the same objects. The <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">client</a> is expected to perform any needed transformations on such data. The <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> specification details the mapping between CTAP2 integer keys and WebAuthn string keys, in section <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#responses" id="ref-for-responses">§6.2. Responses</a>.</p>
    <p>For authenticators, this model defines the logical operations that they MUST support, and the data formats that they expose to
-the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②②">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>,
-unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑤">Relying Parties</a>. For instance, this abstract model does not define protocols for
+the client and the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a>. However, it does not define the details of how authenticators communicate with the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⓪">client device</a>,
+unless they are necessary for interoperability with <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Parties</a>. For instance, this abstract model does not define protocols for
 connecting authenticators to clients over transports such as USB or NFC. Similarly, this abstract model does not define specific
 error codes or methods of returning them; however, it does define error behavior in terms of the needs of the client. Therefore,
 specific error codes are mentioned as a means of showing which error conditions MUST be distinguishable (or not) from each other
 in order to enable a compliant and secure client implementation.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑥">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Parties</a> may influence authenticator selection, if they deem necessary, by stipulating various authenticator characteristics
 when <a href="#sctn-createCredential">creating credentials</a> and/or when <a href="#sctn-getAssertion">generating assertions</a>, through use of <a href="#dictionary-makecredentialoptions">credential creation options</a> or <a href="#dictionary-assertion-options">assertion generation options</a>,
 respectively. The algorithms underlying the <a href="#sctn-api">WebAuthn API</a> marshal these options and pass them to the applicable <a href="#sctn-authenticator-ops">authenticator operations</a> defined below.</p>
    <p>In this abstract model, the authenticator provides key management and cryptographic signatures. It can be embedded in the
@@ -3774,19 +4076,19 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
 operates at a higher security level than the rest of the authenticator. This is particularly important for authenticators that
 are embedded in the WebAuthn client, as in those cases this cryptographic module (which may, for example, be a TPM) could be
 considered more trustworthy than the rest of the authenticator.</p>
-   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑥">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, [<a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>]) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑦">public key credential source</a>.</p>
+   <p>Each authenticator stores a <dfn class="dfn-paneled" data-dfn-for="authenticator" data-dfn-type="dfn" data-noexport id="authenticator-credentials-map">credentials map</dfn>, a <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> from (<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid①">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle">userHandle</a>) to <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a>.</p>
    <p>Additionally, each authenticator has an AAGUID, which is a 128-bit identifier indicating the type (e.g. make and model) of the
 authenticator. The AAGUID MUST be chosen by the manufacturer to be identical across all substantially identical authenticators
 made by that manufacturer, and different (with high probability) from the AAGUIDs of all other types of authenticators.
-The AAGUID for a given type of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑦">Relying Party</a> MAY use the AAGUID to infer certain
+The AAGUID for a given type of authenticator SHOULD be randomly generated to ensure this. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Party</a> MAY use the AAGUID to infer certain
 properties of the authenticator, such as certification level and strength of key protection, using information from other sources.</p>
    <p>The primary function of the authenticator is to provide <a data-link-type="dfn" href="#webauthn-signature" id="ref-for-webauthn-signature①">WebAuthn signatures</a>, which are bound to various contextual data. These
 data are observed and added at different levels of the stack as a signature request passes from the server to the
 authenticator. In verifying a signature, the server checks these bindings against expected values. These contextual bindings
-are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑧">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
-referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①④">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
+are divided in two: Those added by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Party</a> or the client, referred to as <a data-link-type="dfn" href="#client-data" id="ref-for-client-data②">client data</a>; and those added by the authenticator,
+referred to as the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑥">authenticator data</a>. The authenticator signs over the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data③">client data</a>, but is otherwise not interested in
 its contents. To save bandwidth and processing requirements on the authenticator, the client hashes the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data④">client data</a> and
-sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑤">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑤">authenticator data</a>.</p>
+sends only the result to the authenticator. The authenticator signs over the combination of the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash of the serialized client data</a>, and its own <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a>.</p>
    <p>The goals of this design can be summarized as follows.</p>
    <ul>
     <li data-md>
@@ -3796,37 +4098,37 @@ <h2 class="heading settled" data-level="6" id="sctn-authenticator-model"><span c
      <p>The data processed by the authenticator should be small and easy to interpret in low-level code. In particular, authenticators
 should not have to parse high-level encodings such as JSON.</p>
     <li data-md>
-     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑦">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
+     <p>Both the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">client</a> and the authenticator should have the flexibility to add contextual bindings as needed.</p>
     <li data-md>
      <p>The design aims to reuse as much as possible of existing encoding formats in order to aid adoption and implementation.</p>
    </ul>
    <p>Authenticators produce cryptographic signatures for two distinct purposes:</p>
    <ol>
     <li data-md>
-     <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-signature">attestation signature</dfn> is produced when a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential③⑨">public key credential</a> is created via an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⓪">authenticatorMakeCredential</a> operation. An <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①">attestation signature</a> provides cryptographic
-proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②①">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②②">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②②">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation
+     <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-signature">attestation signature</dfn> is produced when a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a> is created via an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⓪">authenticatorMakeCredential</a> operation. An <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature②">attestation signature</a> provides cryptographic
+proof of certain properties of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a> and the credential. For instance, an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature③">attestation signature</a> asserts the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">authenticator</a> type (as denoted by its AAGUID) and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>. The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation
 signature</a> is signed by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key">attestation private key</a>, which is chosen depending on the type of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation⑨">attestation</a> desired.
 For more details on <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⓪">attestation</a>, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
     <li data-md>
      <p>An <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="assertion-signature">assertion signature</dfn> is produced when the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑦">authenticatorGetAssertion</a> method is invoked. It represents an
-assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②③">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">consented</a> to a specific transaction, such as logging
-in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②④">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
-same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⓪">public key credential</a>. It also asserts additional
+assertion by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticator</a> that the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①③">consented</a> to a specific transaction, such as logging
+in, or completing a purchase. Thus, an <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature②">assertion signature</a> asserts that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticator</a> possessing a particular <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key⑨">credential private key</a> has established, to the best of its ability, that the user requesting this transaction is the
+same user who <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①④">consented</a> to creating that particular <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">public key credential</a>. It also asserts additional
 information, termed <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑤">client data</a>, that may be useful to the caller, such as the means by which <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑤">user consent</a> was
-provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑤">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
+provided, and the prompt shown to the user by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a>. The <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature③">assertion signature</a> format is illustrated in <a href="#fig-signature">Figure 4, below</a>.</p>
    </ol>
-   <p>The term <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-signature">WebAuthn signature</dfn> refers to both <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature④">attestation signatures</a> and <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature④">assertion signatures</a>.
+   <p>The term <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-signature">WebAuthn signature</dfn> refers to both <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑤">attestation signatures</a> and <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature④">assertion signatures</a>.
 The formats of these signatures, as well as the procedures for generating them, are specified below.</p>
    <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span class="secno">6.1. </span><span class="content">Authenticator Data</span><a class="self-link" href="#sctn-authenticator-data"></a></h3>
-   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑥">authenticator</a>. These bindings are
-controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②③">WebAuthn Relying Party</a>'s assessment of the security properties of the
+   <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data">authenticator data</dfn> structure encodes contextual bindings made by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a>. These bindings are
+controlled by the authenticator itself, and derive their trust from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a>'s assessment of the security properties of the
 authenticator. In one extreme case, the authenticator may be embedded in the client, and its bindings may be no more trustworthy
 than the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑥">client data</a>. At the other extreme, the authenticator may be a discrete entity with high-security hardware and
-software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑥⑨">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑥">authenticator data</a> in the same
+software, connected to the client over a secure channel. In both cases, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Party</a> receives the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> in the same
 format, and uses its knowledge of the authenticator to make trust decisions.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑦">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
-limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④③">client platform</a>.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑧">authenticator data</a> structure is a byte array of 37 bytes or more,
+   <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> has a compact but extensible encoding. This is desired since authenticators can be devices with
+limited capabilities and low power requirements, with much simpler software stacks than the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">client platform</a>.</p>
+   <p>The <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⓪">authenticator data</a> structure is a byte array of 37 bytes or more,
 laid out as shown in <a href="#table-authData">Table <span class="table-ref-following"></span></a>.</p>
    <figure class="table" id="table-authData">
     <table class="complex data longlastcol">
@@ -3836,17 +4138,17 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
        <th>Length (in bytes)
        <th>Description
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="rpidhash">rpIdHash</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-rpidhash">rpIdHash</dfn>
        <td>32
-       <td> SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑦">RP ID</a> the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④①">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①④">scoped</a> to. 
+       <td> SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④②">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①④">scoped</a> to. 
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="flags">flags</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-flags">flags</dfn>
        <td>1
        <td>
          Flags (bit 0 is the least significant bit): 
         <ul>
          <li data-md>
-          <p>Bit 0: <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present①">User Present</a> (<a data-link-type="dfn" href="#up" id="ref-for-up">UP</a>) result.</p>
+          <p>Bit 0: <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present①">User Present</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-up">UP</dfn>) result.</p>
           <ul>
            <li data-md>
             <p><code>1</code> means the user is <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present②">present</a>.</p>
@@ -3856,7 +4158,7 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
          <li data-md>
           <p>Bit 1: Reserved for future use (<code>RFU1</code>).</p>
          <li data-md>
-          <p>Bit 2: <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified①">User Verified</a> (<a data-link-type="dfn" href="#uv" id="ref-for-uv②">UV</a>) result.</p>
+          <p>Bit 2: <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified①">User Verified</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-uv">UV</dfn>) result.</p>
           <ul>
            <li data-md>
             <p><code>1</code> means the user is <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified②">verified</a>.</p>
@@ -3864,99 +4166,99 @@ <h3 class="heading settled" data-level="6.1" id="sctn-authenticator-data"><span
             <p><code>0</code> means the user is not <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified③">verified</a>.</p>
           </ul>
          <li data-md>
-          <p>Bit 3: <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility①">Backup Eligibility</a> (<a data-link-type="dfn">BE</a>).</p>
+          <p>Bit 3: <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility①">Backup Eligibility</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-be">BE</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑧">credential source</a> is allowed to be backed up</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a> is <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible">backup eligible</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source②⑨">credential source</a> is not allowed to be backed up</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">public key credential source</a> is not <a data-link-type="dfn" href="#backup-eligible" id="ref-for-backup-eligible①">backup eligible</a>.</p>
           </ul>
          <li data-md>
-          <p>Bit 4: <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state①">Backup State</a> (<a data-link-type="dfn">BS</a>).</p>
+          <p>Bit 4: <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state①">Backup State</a> (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-bs">BS</dfn>).</p>
           <ul>
            <li data-md>
-            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⓪">credential source</a> is currently backed up</p>
+            <p><code>1</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">public key credential source</a> is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up①">backed up</a>.</p>
            <li data-md>
-            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③①">credential source</a> is not currently backed up</p>
+            <p><code>0</code> means the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">public key credential source</a> is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up②">backed up</a>.</p>
           </ul>
          <li data-md>
           <p>Bits 5: Reserved for future use (<code>RFU2</code>).</p>
          <li data-md>
-          <p>Bit 6: <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data②">Attested credential data</a> included (<code>AT</code>).</p>
+          <p>Bit 6: <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data②">Attested credential data</a> included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-at">AT</dfn>).</p>
           <ul>
            <li data-md>
             <p>Indicates whether the authenticator added <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data③">attested credential data</a>.</p>
           </ul>
          <li data-md>
-          <p>Bit 7: Extension data included (<code>ED</code>).</p>
+          <p>Bit 7: Extension data included (<dfn class="dfn-paneled" data-dfn-for="authData/flags" data-dfn-type="dfn" data-noexport id="authdata-flags-ed">ED</dfn>).</p>
           <ul>
            <li data-md>
-            <p>Indicates if the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data①⑨">authenticator data</a> has <a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions">extensions</a>.</p>
+            <p>Indicates if the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②①">authenticator data</a> has <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions">extensions</a>.</p>
           </ul>
         </ul>
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signcount">signCount</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-signcount">signCount</dfn>
        <td>4
        <td><a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①">Signature counter</a>, 32-bit unsigned big-endian integer.
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestedcredentialdata">attestedCredentialData</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata">attestedCredentialData</dfn>
        <td>variable (if present)
        <td> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data④">attested credential data</a> (if present). See <a href="#sctn-attested-credential-data">§ 6.5.1 Attested Credential Data</a> for details. Its length depends on
-                the <a data-link-type="dfn" href="#credentialidlength" id="ref-for-credentialidlength">length</a> of the <a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid①">credential ID</a> and <a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey①">credential public
+                the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength">length</a> of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid①">credential ID</a> and <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey①">credential public
                 key</a> being attested. 
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="authDataExtensions" data-noexport id="authdataextensions">extensions</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData" data-dfn-type="dfn" data-noexport id="authdata-extensions">extensions</dfn>
        <td>variable (if present)
-       <td> Extension-defined <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⓪">authenticator data</a>. This is a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑦">CBOR</a> <a data-link-type="biblio" href="#biblio-rfc8949">[RFC8949]</a> map with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier③">extension identifiers</a> as keys,
+       <td> Extension-defined <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②②">authenticator data</a>. This is a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑦">CBOR</a> <a data-link-type="biblio" href="#biblio-rfc8949">[RFC8949]</a> map with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifiers</a> as keys,
                 and <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output②">authenticator extension outputs</a> as values. See <a href="#sctn-extensions">§ 9 WebAuthn Extensions</a> for details. 
     </table>
-    <figcaption> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②①">Authenticator data</a> layout. The names in the Name column are only for reference within this document, and are not
-        present in the actual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②②">authenticator data</a>. </figcaption>
+    <figcaption> <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②③">Authenticator data</a> layout. The names in the Name column are only for reference within this document, and are not
+        present in the actual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②④">authenticator data</a>. </figcaption>
    </figure>
-   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑧">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑧">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertion</a> is generated.
-However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> of a
+   <p>The <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id②⑨">RP ID</a> is originally received from the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> when the credential is created, and again when an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion②">assertion</a> is generated.
+However, it differs from other <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑦">client data</a> in some important ways. First, unlike the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data⑧">client data</a>, the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> of a
 credential does not change between operations but instead remains the same for the lifetime of that credential. Secondly, it is
-validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⓪">RP ID</a> that
-the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④②">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑤⑨">client</a>.</p>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑦">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②③">authenticator data</a> structure</dfn>:</p>
+validated by the authenticator during the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑧">authenticatorGetAssertion</a> operation, by verifying that the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③①">RP ID</a> that
+the requested <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑤">scoped</a> to exactly matches the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> supplied by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a>.</p>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">Authenticators</a> <dfn class="dfn-paneled" data-dfn-for="authenticator data" data-dfn-type="dfn" data-noexport id="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">authenticator data</a> structure</dfn>:</p>
    <ul>
     <li data-md>
-     <p>Hash <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③②">RP ID</a> using SHA-256 to generate the <a data-link-type="dfn" href="#rpidhash" id="ref-for-rpidhash">rpIdHash</a>.</p>
+     <p>Hash <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a> using SHA-256 to generate the <a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash">rpIdHash</a>.</p>
     <li data-md>
-     <p>The <code>UP</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags④">flag</a> SHALL be set if and only if the authenticator performed a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑥">test of user presence</a>.
-The <code>UV</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags⑤">flag</a> SHALL be set if and only if the authenticator performed <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a>.
+     <p>The <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑥">flag</a> SHALL be set if and only if the authenticator performed a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑥">test of user presence</a>.
+The <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv②">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑦">flag</a> SHALL be set if and only if the authenticator performed <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑦">user verification</a>.
 The <code>RFU</code> bits SHALL be set to zero.</p>
      <p class="note" role="note"><span>Note:</span> If the authenticator performed both a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑦">test of user presence</a> and <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑧">user verification</a>,
 possibly combined in a single <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑥">authorization gesture</a>,
-then the authenticator will set both the <code>UP</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags⑥">flag</a> and the <code>UV</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags⑦">flag</a>.</p>
+then the authenticator will set both the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up①">UP</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑧">flag</a> and the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv③">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags⑨">flag</a>.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑤">attestation signatures</a>, the authenticator MUST set the AT <a data-link-type="dfn" href="#flags" id="ref-for-flags⑧">flag</a> and include the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata②">attestedCredentialData</a></code>.
-For <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑤">assertion signatures</a>, the AT <a data-link-type="dfn" href="#flags" id="ref-for-flags⑨">flag</a> MUST NOT be set and the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata③">attestedCredentialData</a></code> MUST NOT be included.</p>
+     <p>For <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑥">attestation signatures</a>, the authenticator MUST set the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⓪">flag</a> and include the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata②">attestedCredentialData</a></code>.
+For <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑤">assertion signatures</a>, the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at①">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①①">flag</a> MUST NOT be set and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata③">attestedCredentialData</a></code> MUST NOT be included.</p>
     <li data-md>
-     <p>If the authenticator does not include any <a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions①">extension data</a>, it MUST set the <code>ED</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags①⓪">flag</a> to zero, and to one if <a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions②">extension data</a> is included.</p>
+     <p>If the authenticator does not include any <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions①">extension data</a>, it MUST set the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①②">flag</a> to zero, and to one if <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions②">extension data</a> is included.</p>
    </ul>
-   <p><a href="#fig-authData">Figure <span class="figure-num-following"></span></a> shows a visual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②④">authenticator data</a> structure.</p>
+   <p><a href="#fig-authData">Figure <span class="figure-num-following"></span></a> shows a visual representation of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> structure.</p>
    <figure id="fig-authData">
      <img src="images/fido-signature-formats-figure1.svg"> 
-    <figcaption><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑤">Authenticator data</a> layout.</figcaption>
+    <figcaption><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑦">Authenticator data</a> layout.</figcaption>
    </figure>
    <div class="note" role="note">
-     Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑥">authenticator data</a> describes its own length: If the AT and ED <a data-link-type="dfn" href="#flags" id="ref-for-flags①①">flags</a> are not set, it is always 37 bytes long.
-    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (which is only present if the AT <a data-link-type="dfn" href="#flags" id="ref-for-flags①②">flag</a> is set) describes its own length. If the ED <a data-link-type="dfn" href="#flags" id="ref-for-flags①③">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a> (if the AT <a data-link-type="dfn" href="#flags" id="ref-for-flags①④">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
+     Note: <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> describes its own length: If the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at②">AT</a> and <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed①">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①③">flags</a> are not set, it is always 37 bytes long.
+    The <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑤">attested credential data</a> (which is only present if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at③">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①④">flag</a> is set) describes its own length. If the <a data-link-type="dfn" href="#authdata-flags-ed" id="ref-for-authdata-flags-ed②">ED</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑤">flag</a> is set, then the total length is 37 bytes plus the length of the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑥">attested credential data</a> (if the <a data-link-type="dfn" href="#authdata-flags-at" id="ref-for-authdata-flags-at④">AT</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑥">flag</a> is set), plus the length of the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions③">extensions</a> output (a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑧">CBOR</a> map) that
     follows. 
-    <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#credentialidlength" id="ref-for-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7①">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a>).</p>
+    <p>Determining <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑦">attested credential data</a>'s length, which is variable, involves determining <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey②">credentialPublicKey</a></code>’s beginning location given the preceding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid②">credentialId</a></code>’s <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialidlength" id="ref-for-authdata-attestedcredentialdata-credentialidlength①">length</a>, and then determining the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey③">credentialPublicKey</a></code>’s length (see also <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7①">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a>).</p>
    </div>
    <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span class="secno">6.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signature-counter">Signature Counter</dfn> Considerations</span><a class="self-link" href="#sctn-sign-counter"></a></h4>
    <p>Authenticators SHOULD implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②">signature counter</a> feature. These counters are conceptually stored for each credential
-by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑦">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②④">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑧">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⓪">Relying Parties</a> in detecting cloned authenticators. Clone
+by the authenticator, or globally for the authenticator as a whole. The initial value of a credential’s <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter③">signature counter</a> is specified in the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount①">signCount</a></code> value of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> returned by <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①①">authenticatorMakeCredential</a>. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter④">signature counter</a> is incremented for each successful <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion⑨">authenticatorGetAssertion</a> operation by some positive value, and subsequent values are returned to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a> within the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a> again. The <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑤">signature counter</a>'s purpose is to aid <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Parties</a> in detecting cloned authenticators. Clone
 detection is more important for authenticators with limited protection measures.</p>
-   <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount①">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data②⑨">authenticator data</a> constant at zero.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦①">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦②">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount②">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⓪">authenticator data</a>.  If either is non-zero, and the new <code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount③">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
-   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦③">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
+   <p>Authenticators that do not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑥">signature counter</a> leave the <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount②">signCount</a></code> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> constant at zero.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> stores the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑦">signature counter</a> of the most recent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⓪">authenticatorGetAssertion</a> operation. (Or the counter from the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①②">authenticatorMakeCredential</a> operation if no <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①①">authenticatorGetAssertion</a> has ever been performed on a credential.) In subsequent <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①②">authenticatorGetAssertion</a> operations, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a> compares the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑧">signature counter</a> value with the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount③">signCount</a></code> value returned in the assertion’s <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a>. If either is non-zero, and the new <code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount④">signCount</a></code> value is less than or equal to the stored value, a cloned authenticator may exist, or the authenticator may be malfunctioning.</p>
+   <p>Detecting a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter⑨">signature counter</a> mismatch does not indicate whether the current operation was performed by a cloned authenticator or the original authenticator. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Parties</a> should address this situation appropriately relative to their individual situations, i.e., their risk tolerance.</p>
    <p>Authenticators:</p>
    <ul>
     <li data-md>
-     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦④">Relying Parties</a> and being possibly employed
+     <p>SHOULD implement per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⓪">signature counters</a>.  This prevents the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①①">signature counter</a> value from being shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Parties</a> and being possibly employed
 as a correlation handle for the user. Authenticators MAY implement a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①②">signature counter</a>,
 i.e., on a per-authenticator basis, but this is less privacy-friendly for users.</p>
     <li data-md>
@@ -3964,22 +4266,22 @@ <h4 class="heading settled" data-level="6.1.1" id="sctn-sign-counter"><span clas
 accidentally decrease  (e.g., due to hardware failures).</p>
    </ul>
    <h4 class="heading settled" data-level="6.1.2" id="sctn-fido-u2f-sig-format-compat"><span class="secno">6.1.2. </span><span class="content">FIDO U2F Signature Format Compatibility</span><a class="self-link" href="#sctn-fido-u2f-sig-format-compat"></a></h4>
-   <p>The format for <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑥">assertion signatures</a>, which sign over the concatenation of an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③①">authenticator data</a> structure and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">hash
+   <p>The format for <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑥">assertion signatures</a>, which sign over the concatenation of an <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a> structure and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑦">hash
 of the serialized client data</a>, are compatible with the FIDO U2F authentication signature format (see <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-response-message-success" id="ref-for-authentication-response-message-success">Section 5.4</a> of <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a>).</p>
-   <p>This is because the first 37 bytes of the signed data in a FIDO U2F authentication response message constitute a valid <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③②">authenticator data</a> structure, and the remaining 32 bytes are the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑦">hash of the serialized client data</a>. In this <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③③">authenticator data</a> structure, the <code><a data-link-type="dfn" href="#rpidhash" id="ref-for-rpidhash①">rpIdHash</a></code> is the FIDO U2F <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate" id="ref-for-authentication-request-message---u2f_authenticate">application parameter</a>, all <code><a data-link-type="dfn" href="#flags" id="ref-for-flags①⑤">flags</a></code> except <code><a data-link-type="dfn" href="#up" id="ref-for-up①">UP</a></code> are always zero, and the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata④">attestedCredentialData</a></code> and <code><a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions④">extensions</a></code> are never present. FIDO U2F authentication signatures can therefore be verified by
+   <p>This is because the first 37 bytes of the signed data in a FIDO U2F authentication response message constitute a valid <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③④">authenticator data</a> structure, and the remaining 32 bytes are the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">hash of the serialized client data</a>. In this <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑤">authenticator data</a> structure, the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash①">rpIdHash</a></code> is the FIDO U2F <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#authentication-request-message---u2f_authenticate" id="ref-for-authentication-request-message---u2f_authenticate">application parameter</a>, all <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑦">flags</a></code> except <code><a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up②">UP</a></code> are always zero, and the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata④">attestedCredentialData</a></code> and <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions④">extensions</a></code> are never present. FIDO U2F authentication signatures can therefore be verified by
 the same procedure as other <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑦">assertion signatures</a> generated by the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①③">authenticatorGetAssertion</a> operation.</p>
    <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span class="secno">6.1.3. </span><span class="content">Credential Backup State</span><a class="self-link" href="#sctn-credential-backup"></a></h4>
-   <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <code>BE</code> and <code>BS</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags①⑥">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③④">authenticator data</a>, as
+   <p>Credential <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility②">backup eligibility</a> and current <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state②">backup state</a> is conveyed by the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be①">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑧">flags</a> in the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a>, as
 defined in <a href="#table-authData">Table <span class="table-ref-previous"></span></a>.</p>
-   <p>The value of the <code>BE</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags①⑦">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
-   <p>The value of the <code>BS</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags①⑧">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③②">credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be②">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags①⑨">flag</a> is set during <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①③">authenticatorMakeCredential</a> operation and MUST NOT change.</p>
+   <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs②">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⓪">flag</a> may change over time based on the current state of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">public key credential source</a>. <a href="#table-backupStates">Table <span class="table-ref-following"></span></a> below defines
 valid combinations and their meaning.</p>
    <figure class="table" id="table-backupStates">
     <table class="complex data longlastcol">
      <tbody>
       <tr>
-       <th><code>BE</code>
-       <th><code>BS</code>
+       <th><a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be③">BE</a>
+       <th><a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs③">BS</a>
        <th>Description
       <tr>
        <td><code>0</code>
@@ -3992,39 +4294,39 @@ <h4 class="heading settled" data-level="6.1.3" id="sctn-credential-backup"><span
       <tr>
        <td><code>1</code>
        <td><code>0</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credential</a> and is not yet backed up. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential②">multi-device credential</a> and is not currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up③">backed up</a>. 
       <tr>
        <td><code>1</code>
        <td><code>1</code>
-       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is backed up. 
+       <td> The credential is a <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential③">multi-device credential</a> and is currently <a data-link-type="dfn" href="#backed-up" id="ref-for-backed-up④">backed up</a>. 
     </table>
-    <figcaption> <code>BE</code> and <code>BS</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags①⑨">flag</a> combinations </figcaption>
+    <figcaption> <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be④">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs④">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②①">flag</a> combinations </figcaption>
    </figure>
-   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑤">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#flags" id="ref-for-flags②⓪">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑥">user account</a> for future evaluation.</p>
-   <p>The following is a non-normative, non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑥">Relying Parties</a> might use these <a data-link-type="dfn" href="#flags" id="ref-for-flags②①">flags</a>:</p>
+   <p>It is RECOMMENDED that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Parties</a> store the most recent value of these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②②">flags</a> with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account</a> for future evaluation.</p>
+   <p>The following is a non-exhaustive list of how <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Parties</a> might use these <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②③">flags</a>:</p>
    <ul>
     <li data-md>
-     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑧">authenticators</a>:</p>
-     <p>When <code>BE</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags②②">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
+     <p>Requiring additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticators</a>:</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑤">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②④">flag</a> is set to <code>0</code>, the credential is a <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential②">single-device credential</a> and the <a data-link-type="dfn" href="#generating-authenticator" id="ref-for-generating-authenticator③">generating authenticator</a> will never
 allow the credential to be backed up.</p>
-     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑦">Relying Parties</a> SHOULD ensure that a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑦">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①②⑨">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registered</a> and/or an account recovery process in place.</p>
-     <p>For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⓪">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③①">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credentials</a>.</p>
+     <p>A <a data-link-type="dfn" href="#single-device-credential" id="ref-for-single-device-credential③">single-device credential</a> is not resilient to single device loss. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Parties</a> SHOULD ensure that each <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> has additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticators</a> <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑥">registered</a> and/or an account recovery process in place.
+For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a>, such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑦">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential④">multi-device credentials</a>.</p>
     <li data-md>
      <p>Upgrading a user to a password-free account:</p>
-     <p>When the <code>BS</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags②③">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③②">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> is backed up and is protected from single device loss.</p>
-     <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑧">Relying Party</a> may decide to prompt the user to upgrade their account security and remove their password.</p>
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑤">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑤">flag</a> changes from <code>0</code> to <code>1</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①③">credential</a> is backed up and is protected from single device loss.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> MAY choose to prompt the user to upgrade their account security and remove their password.</p>
     <li data-md>
      <p>Adding an additional factor after a state change:</p>
-     <p>When the <code>BS</code> <a data-link-type="dfn" href="#flags" id="ref-for-flags②④">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③③">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is no longer backed up,
-and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service, 
+     <p>When the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑥">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑥">flag</a> changes from <code>1</code> to <code>0</code>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a> is signaling that the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①④">credential</a> is no longer backed up,
+and no longer protected from single device loss. This could be the result of the user actions, such as disabling the backup service,
 or errors, such as issues with the backup service.</p>
-     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑦⑨">Relying Party</a> SHOULD guide the user through a process to validate their other sign in factors.
-If the user does not have another credential for their account, they SHOULD be guided through adding an additional authentication factor 
-to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③④">authenticator</a>, 
-such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑤">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
+     <p>When this transition occurs, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a> SHOULD guide the user through a process to validate their other authentication factors.
+If the user does not have another credential for their account, they SHOULD be guided through adding an additional credential
+to ensure they do not lose access to their account. For example, the user could be prompted to set up an additional <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticator</a>,
+such as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators⑧">roaming authenticator</a> or an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticator</a> that is capable of <a data-link-type="dfn" href="#multi-device-credential" id="ref-for-multi-device-credential⑤">multi-device credentials</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><span class="secno">6.2. </span><span class="content">Authenticator Taxonomy</span><a class="self-link" href="#sctn-authenticator-taxonomy"></a></h3>
-   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑥">authenticator</a> used.
+   <p>Many use cases are dependent on the capabilities of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a> used.
 This section defines some terminology for those capabilities, their most important combinations,
 and which use cases those combinations enable.</p>
    <p>For example:</p>
@@ -4036,9 +4338,9 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
      <p>For subsequent re-authentication on the same <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②④">client device</a>, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①④">platform authenticator</a> is likely the most convenient
 since it’s built directly into the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑤">client device</a> rather than being a separate device that the user may have to locate.</p>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑦">authenticator</a> can be used.</p>
+     <p>For <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①">second-factor</a> authentication in addition to a traditional username and password, any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticator</a> can be used.</p>
     <li data-md>
-     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑧">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
+     <p>Passwordless <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②">multi-factor</a> authentication requires an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a> capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification②⑨">user verification</a>, and in some cases also <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable①">discoverable credential capable</a>.</p>
     <li data-md>
      <p>A laptop computer might support connecting to <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⓪">roaming authenticators</a> via USB and Bluetooth,
 while a mobile phone might only support NFC.</p>
@@ -4046,9 +4348,9 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
    <p>The above examples illustrate the the primary <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-type">authenticator type</dfn> characteristics:</p>
    <ul>
     <li data-md>
-     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①③⑨">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform</a> authenticator
+     <p>Whether the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticator</a> is a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①①">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑤">platform</a> authenticator
 — the <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①①">authenticator attachment modality</a>.
-A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⓪">client</a>.</p>
+A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①②">roaming authenticator</a> can support one or more <a href="#enum-transport">transports</a> for communicating with the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a>.</p>
     <li data-md>
      <p>Whether the authenticator is capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⓪">user verification</a> — the <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability">authentication factor capability</a>.</p>
     <li data-md>
@@ -4097,8 +4399,8 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
 In addition to the proof of possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⓪">credential private key</a>,
 these authenticators support <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③①">user verification</a> as a second <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af④">authentication factor</a>,
 typically a PIN or <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition③">biometric recognition</a>.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⓪">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">authentication factor</a>,
-which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⓪">Relying Party</a>.</p>
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticator</a> can thus act as two kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑤">authentication factor</a>,
+which enables <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑥">multi-factor</a> authentication while eliminating the need to share a password with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a>.</p>
    <p>The four combinations not named in <a href="#table-authenticatorTypes">Table <span class="table-ref-previous"></span></a> have less distinguished use cases:</p>
    <ul>
     <li data-md>
@@ -4108,86 +4410,86 @@ <h3 class="heading settled" data-level="6.2" id="sctn-authenticator-taxonomy"><s
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①④">roaming authenticator</a> that is <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable③">discoverable credential capable</a> but not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable②">multi-factor capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#sf" id="ref-for-sf">single-factor</a> authentication without a username,
 where the user is automatically identified by the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑧">user handle</a> and possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①①">credential private key</a> is used as the only <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑦">authentication factor</a>.
-This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④①">authenticator</a>.</p>
+This can be useful in some situations, but makes the user particularly vulnerable to theft of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑤">roaming authenticator</a> that is <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable③">multi-factor capable</a> but not <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable④">discoverable credential capable</a> can be used for <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑧">multi-factor</a> authentication, but requires the user to be identified first
 which risks leaking personally identifying information; see <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
    </ul>
    <p>The following subsections define the aspects <a data-link-type="dfn" href="#authenticator-attachment-modality" id="ref-for-authenticator-attachment-modality①③">authenticator attachment modality</a>, <a data-link-type="dfn" href="#credential-storage-modality" id="ref-for-credential-storage-modality③">credential storage modality</a> and <a data-link-type="dfn" href="#authentication-factor-capability" id="ref-for-authentication-factor-capability②">authentication factor capability</a> in more depth.</p>
    <h4 class="heading settled" data-level="6.2.1" id="sctn-authenticator-attachment-modality"><span class="secno">6.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-attachment-modality">Authenticator Attachment Modality</dfn></span><a class="self-link" href="#sctn-authenticator-attachment-modality"></a></h4>
-   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑥①">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④②">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑥②">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑨">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④③">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑥③">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
-and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment④">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④④">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑤">authenticators</a> that
+   <p><a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">Clients</a> can communicate with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticators</a> using a variety of mechanisms. For example, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a> MAY use a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device②⑨">client device</a>-specific API to communicate with an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> which is physically bound to a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⓪">client device</a>. On the other hand, a <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> can use a variety of standardized cross-platform transport protocols such as Bluetooth (see <a href="#enum-transport">§ 5.8.4 Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>) to discover
+and communicate with <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment④">cross-platform attached</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticators</a>. We refer to <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticators</a> that
 are part of the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③①">client device</a> as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-authenticators">platform authenticators</dfn>, while those that are reachable via cross-platform
 transport protocols are referred to as <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="roaming-authenticators">roaming authenticators</dfn>.</p>
    <ul>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑧">platform authenticator</a> is attached using a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③②">client device</a>-specific transport, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-attachment">platform attachment</dfn>, and is usually not removable from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③③">client
-device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④③">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
+device</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①①">bound</a> to a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators①⑨">platform authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="platform-credential">platform credential</dfn>.</p>
     <li data-md>
      <p>A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑥">roaming authenticator</a> is attached using cross-platform transports, called <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="cross-platform-attachment">cross-platform attachment</dfn>. Authenticators of this class are removable from, and
-can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④④">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
+can "roam" between, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③④">client devices</a>. A <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑤">public key credential</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①②">bound</a> to a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑦">roaming authenticator</a> is called a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="roaming credential" data-noexport id="roaming-credential">roaming
 credential</dfn>.</p>
    </ul>
    <p>Some <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⓪">platform authenticators</a> could possibly also act as <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑧">roaming authenticators</a> depending on context. For example, a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②①">platform authenticator</a> integrated into a mobile device could make itself available as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators①⑨">roaming authenticator</a> via
 Bluetooth.
-In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑥④">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
-while <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑤">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client device</a> and communicating with the same authenticator via Bluetooth
+In this case <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">clients</a> running on the mobile device would recognise the authenticator as a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②②">platform authenticator</a>,
+while <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">clients</a> running on a different <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑤">client device</a> and communicating with the same authenticator via Bluetooth
 would recognize it as a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⓪">roaming authenticator</a>.</p>
    <p>The primary use case for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②③">platform authenticators</a> is to register a particular <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑥">client device</a> as a "trusted device",
 so the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑦">client device</a> itself acts as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af⑨">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⓪">authentication factor</a> for future <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①①">authentication</a>.
 This gives the user the convenience benefit
-of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑤">authentication ceremonies</a>, e.g., the user will not have to dig around in
+of not needing a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②①">roaming authenticator</a> for future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremonies</a>, e.g., the user will not have to dig around in
 their pocket for their key fob or phone.</p>
    <p>Use cases for <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②②">roaming authenticators</a> include: <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①②">authenticating</a> on a new <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑧">client device</a> for the first time,
 on rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device③⑨">client devices</a>, <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⓪">client devices</a> shared between multiple users,
 or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④①">client devices</a> that do not include a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②④">platform authenticator</a>;
-and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑥">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> it is used with.
+and when policy or preference dictates that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a> be kept separate from the <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④②">client devices</a> it is used with.
 A <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②③">roaming authenticator</a> can also be used to hold
-backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑤">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑦">authenticator</a> is lost.</p>
+backup <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a> in case another <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> is lost.</p>
    <h4 class="heading settled" data-level="6.2.2" id="sctn-credential-storage-modality"><span class="secno">6.2.2. </span><span class="content">Credential Storage Modality</span><a class="self-link" href="#sctn-credential-storage-modality"></a></h4>
-   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑧">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③③">public key credential source</a> in one of two ways:</p>
+   <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> can store a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">public key credential source</a> in one of two ways:</p>
    <ol>
     <li data-md>
-     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①④⑨">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑥">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client device</a>, e.g., in a secure element.
+     <p>In persistent storage embedded in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a> or <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④③">client device</a>, e.g., in a secure element.
 This is a technical requirement for a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source③">client-side discoverable public key credential source</a>.</p>
     <li data-md>
-     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⓪">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
-ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②②">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③④">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②③">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧①">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤①">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①②">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑥">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤②">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
-     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤③">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧②">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤④">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧③">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> can use it.</p>
+     <p>By encrypting (i.e., wrapping) the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①②">credential private key</a> such that only this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑤">authenticator</a> can decrypt (i.e., unwrap) it and letting the resulting
+ciphertext be the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a> for the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">public key credential source</a>. The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential ID</a> is stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a> and returned to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> via the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①④">allowCredentials</a></code> option of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, which allows the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a> to decrypt and use the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①③">credential private key</a>.</p>
+     <p>This enables the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a> to have unlimited storage capacity for <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①④">credential private keys</a>, since the encrypted <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑤">credential private keys</a> are stored by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> instead of by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticator</a> - but it means that a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑤">credential</a> stored in this way must be retrieved from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a> before the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> can use it.</p>
    </ol>
-   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑥">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑦">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
+   <p>Which of these storage strategies an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a> supports defines the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="credential storage modality" data-noexport id="credential-storage-modality">credential storage
 modality</dfn> as follows:</p>
    <ul>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑧">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
-credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑤⑨">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality④">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-side-credential-storage-modality">client-side credential storage modality</dfn> if it supports <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source④">client-side discoverable public key
+credential sources</a>. An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> with <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality④">client-side credential storage modality</a> is also called <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="discoverable credential capable" data-noexport id="discoverable-credential-capable">discoverable
 credential capable</dfn>.</p>
     <li data-md>
-     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⓪">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage
-modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private keys</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②④">credential ID</a>.</p>
+     <p>An <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> has the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="server-side-credential-storage-modality">server-side credential storage modality</dfn> if it does not have the <a data-link-type="dfn" href="#client-side-credential-storage-modality" id="ref-for-client-side-credential-storage-modality⑤">client-side credential storage
+modality</a>, i.e., it only supports storing <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑥">credential private keys</a> as a ciphertext in the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential ID</a>.</p>
    </ul>
-   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥①">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥②">authenticator</a> MAY
-at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑥">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②①">create()</a></code>.</p>
+   <p>Note that a <a data-link-type="dfn" href="#discoverable-credential-capable" id="ref-for-discoverable-credential-capable⑤">discoverable credential capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> MAY support both storage strategies. In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> MAY
+at its discretion use different storage strategies for different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credentials</a>, though subject to the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑥">residentKey</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-requireresidentkey" id="ref-for-dom-authenticatorselectioncriteria-requireresidentkey④">requireResidentKey</a></code> options of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">create()</a></code>.</p>
    <h4 class="heading settled" data-level="6.2.3" id="sctn-authentication-factor-capability"><span class="secno">6.2.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-factor-capability">Authentication Factor Capability</dfn></span><a class="self-link" href="#sctn-authentication-factor-capability"></a></h4>
-   <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑥">authentication
+   <p>There are three broad classes of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①①">authentication factors</a> that can be used to prove an identity during an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication
 ceremony</a>: <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①②">something you have</a>, <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①③">something you know</a> and <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①④">something you are</a>. Examples include a physical key, a password,
 and a fingerprint, respectively.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑤">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑤">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥③">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user
-verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑥">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥④">authenticator</a> can
-verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑦">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑤">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑥">authenticator</a> that is
-not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑦">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>.</p>
-   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧④">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> was performed by setting the <a data-link-type="dfn" href="#uv" id="ref-for-uv③">UV</a> <a data-link-type="dfn" href="#flags" id="ref-for-flags②⑤">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑤">Relying Party</a>.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑥">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#uv" id="ref-for-uv④">UV</a> flag to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑤">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑦">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#uv" id="ref-for-uv⑤">UV</a> <a data-link-type="dfn" href="#flags" id="ref-for-flags②⑥">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑥">attestation statement</a>.</p>
+   <p>All <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑤">WebAuthn Authenticators</a> belong to the <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑤">something you have</a> class, but an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑧">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③②">user
+verification</a> can also act as one or two additional kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑥">authentication factor</a>. For example, if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑥⑨">authenticator</a> can
+verify a PIN, the PIN is <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑦">something you know</a>, and a <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator">biometric authenticator</a> can verify <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑧">something you are</a>. Therefore, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⓪">authenticator</a> that supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③③">user verification</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="multi-factor-capable">multi-factor capable</dfn>. Conversely, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> that is
+not <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable④">multi-factor capable</a> is <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="single-factor-capable">single-factor capable</dfn>. Note that a single <a data-link-type="dfn" href="#multi-factor-capable" id="ref-for-multi-factor-capable⑤">multi-factor capable</a> <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> could support several modes of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③④">user verification</a>, meaning it could act as all three kinds of <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af①⑨">authentication factor</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑤">user verification</a> is performed locally on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> and not by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Party</a>, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a> indicates if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑥">user verification</a> was performed by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv④">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑦">flag</a> in the signed response returned to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Party</a>.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Party</a> can therefore use the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑤">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑧">flag</a> to verify that additional <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②⓪">authentication factors</a> were used in a <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremony</a>. The authenticity of the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑥">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags②⑨">flag</a> can in turn be assessed by inspecting the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a>'s <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a>.</p>
    <h3 class="heading settled" data-level="6.3" id="sctn-authenticator-ops"><span class="secno">6.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-operations">Authenticator Operations</dfn></span><a class="self-link" href="#sctn-authenticator-ops"></a></h3>
    <p>A <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑥">WebAuthn Client</a> MUST connect to an authenticator in order to invoke any of the operations of that authenticator. This connection
 defines an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-session">authenticator session</dfn>. An authenticator must maintain isolation between sessions. It may do this by only allowing one
 session to exist at any particular time, or by providing more complicated session management.</p>
    <p>The following operations can be invoked by the client in an authenticator session.</p>
    <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-credid"><span class="secno">6.3.1. </span><span class="content">Lookup Credential Source by Credential ID Algorithm</span><a class="self-link" href="#sctn-op-lookup-credsource-by-credid"></a></h4>
-   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑤">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦①">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
+   <p>The result of <dfn class="dfn-paneled" data-dfn-for="credential id" data-dfn-type="dfn" data-noexport id="credential-id-looking-up">looking up</dfn> a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential id</a> <var>credentialId</var> in an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> <var>authenticator</var> is the result of the following algorithm:</p>
    <ol>
     <li data-md>
-     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑤">public key credential source</a> <var>credSource</var>:</p>
+     <p>If <var>authenticator</var> can decrypt <var>credentialId</var> into a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">public key credential source</a> <var>credSource</var>:</p>
      <ol>
       <li data-md>
        <p>Set <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id">id</a> to <var>credentialId</var>.</p>
@@ -4195,7 +4497,7 @@ <h4 class="heading settled" data-level="6.3.1" id="sctn-op-lookup-credsource-by-
        <p>Return <var>credSource</var>.</p>
      </ol>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate②">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤②">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map①">credentials map</a>:</p>
      <ol>
       <li data-md>
        <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id①">id</a> is <var>credentialId</var>, return <var>credSource</var>.</p>
@@ -4208,16 +4510,16 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
    <dl>
     <dt data-md><var>hash</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">hash of the serialized client data</a>, provided by the client.</p>
+     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>rpEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑦">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑤">PublicKeyCredentialRpEntity</a></code>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a>'s <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrpentity" id="ref-for-dictdef-publickeycredentialrpentity⑥">PublicKeyCredentialRpEntity</a></code>.</p>
     <dt data-md><var>userEntity</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑧">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑧">Relying Party</a>.</p>
+     <p>The <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account’s</a> <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑤">PublicKeyCredentialUserEntity</a></code>, containing the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle①⑨">user handle</a> given by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a>.</p>
     <dt data-md><var>requireResidentKey</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑦">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-resident-key-requirement-for-credential-creation" id="ref-for-effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a>.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
      <p>The constant Boolean value <code>true</code>.
@@ -4225,14 +4527,14 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
 wish to make a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑧">test of user presence</a> optional although WebAuthn does not.</p>
     <dt data-md><var>requireUserVerification</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑧">client</a>.</p>
+     <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-credential-creation" id="ref-for-effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a>, a Boolean value determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a>.</p>
     <dt data-md><var>credTypesAndPubKeyAlgs</var>
     <dd data-md>
-     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①⓪">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑧⑨">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦②">authenticator</a> makes a best-effort to create the most
+     <p>A sequence of pairs of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑧">PublicKeyCredentialType</a></code> and public key algorithms (<code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①⓪">COSEAlgorithmIdentifier</a></code>) requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Party</a>. This sequence is ordered from most preferred to least preferred. The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a> makes a best-effort to create the most
 preferred credential that it can.</p>
     <dt data-md><var>excludeCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①⓪">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⓪">Relying Party</a> with the intention that, if any of
+     <p>An OPTIONAL list of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">PublicKeyCredentialDescriptor</a></code> objects provided by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a> with the intention that, if any of
 these are known to the authenticator, it SHOULD NOT create a new credential. <var>excludeCredentialDescriptorList</var> contains a
 list of known credentials.</p>
     <dt data-md><var>enterpriseAttestationPossible</var>
@@ -4240,25 +4542,25 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>A Boolean value that indicates that individually-identifying attestation MAY be returned by the authenticator.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑦">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier④">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑥⑨">client</a> based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨①">Relying Party</a>, if any.</p>
+     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor⑨">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①⓪">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑤">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①">authenticator extension inputs</a>, created by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> based on
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span>Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session②">authenticator session</a> MUST be aborted by
 running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①①">authenticatorCancel</a> operation.</p>
-   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦③">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
      <p>Check if at least one of the specified combinations of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype⑨">PublicKeyCredentialType</a></code> and cryptographic parameters in <var>credTypesAndPubKeyAlgs</var> is supported.
-If not, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror②">NotSupportedError</a></code>" and terminate the operation.</p>
+If not, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑥">For each</a> <var>descriptor</var> of <var>excludeCredentialDescriptorList</var>:</p>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑦">For each</a> <var>descriptor</var> of <var>excludeCredentialDescriptorList</var>:</p>
      <ol>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id②">id</a></code></code> in this authenticator
-returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑦">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③③">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type③">type</a></code></code> respectively,
+       <p>If <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑤">id</a></code></code> in this authenticator
+returns non-null, and the returned <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">item</a>'s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③④">RP ID</a> and <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a> match <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①⓪">id</a></code></code> and <code><var>excludeCredentialDescriptorList</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code></code> respectively,
 then collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑦">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑥">user
 consent</a> for creating a new credential. The <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑧">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence⑨">test
 of user presence</a>. If the user</p>
@@ -4271,10 +4573,10 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
          <p>return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror⑨">NotAllowedError</a></code>" and terminate the operation.</p>
        </dl>
        <p class="note" role="note"><span>Note:</span> The purpose of this <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture①⑨">authorization gesture</a> is not to proceed with creating a credential,
-but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id③">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦④">authenticator</a>.
-If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨②">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑤">authenticator</a>.
+but for privacy reasons to authorize disclosure of the fact that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑥">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①③">bound</a> to this <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a>.
+If the user consents, the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> can detect this and guide the user to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a>.
 If the user does not consent,
-the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑥">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id④">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
+the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> does not reveal that <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑦">id</a></code></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①④">bound</a> to it,
 and responds as if the user simply declined consent to create a credential.</p>
      </ol>
     <li data-md>
@@ -4286,7 +4588,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
     <li id="op-makecred-step-user-consent">
      <a class="self-link" href="#op-makecred-step-user-consent"></a> Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⓪">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑦">user consent</a> for creating a new credential.
     The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②①">authorization gesture</a> is shown by the
-    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①①">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①①">displayName</a></code></code>, if possible. 
+    authenticator if it has its own output capability, or by the user agent otherwise. The prompt SHOULD display <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①①">id</a></code></code>, <code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①②">name</a></code></code>, <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code></code> and <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code></code>, if possible. 
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②②">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑧">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②③">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①⓪">test of user presence</a>.</p>
      <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑧">consent</a> or if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification③⑨">user verification</a> fails, return an error code equivalent to
@@ -4295,14 +4597,14 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>Once the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②④">authorization gesture</a> has been completed and <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent①⑨">user consent</a> has been obtained, generate a new credential object:</p>
      <ol>
       <li data-md>
-       <p>Let (<var>publicKey</var>, <var>privateKey</var>) be a new pair of cryptographic keys using the combination of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①⓪">PublicKeyCredentialType</a></code> and cryptographic parameters represented by the first <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑧">item</a> in <var>credTypesAndPubKeyAlgs</var> that is supported by
+       <p>Let (<var>publicKey</var>, <var>privateKey</var>) be a new pair of cryptographic keys using the combination of <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①⓪">PublicKeyCredentialType</a></code> and cryptographic parameters represented by the first <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①⓪">item</a> in <var>credTypesAndPubKeyAlgs</var> that is supported by
 this authenticator.</p>
       <li data-md>
        <p>Let <var>userHandle</var> be <code><var>userEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑧">id</a></code></code>.</p>
       <li data-md>
-       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑦">public key credential source</a> with the fields:</p>
+       <p>Let <var>credentialSource</var> be a new <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤③">public key credential source</a> with the fields:</p>
        <dl>
-        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type①">type</a>
+        <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
         <dd data-md>
          <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key④">public-key</a></code>.</p>
         <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey">privateKey</a>
@@ -4322,13 +4624,13 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
        <p>If <var>requireResidentKey</var> is <code>true</code> or the authenticator chooses to create a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑥">client-side discoverable public key credential source</a>:</p>
        <ol>
         <li data-md>
-         <p>Let <var>credentialId</var> be a new <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑥">credential id</a>.</p>
+         <p>Let <var>credentialId</var> be a new <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑧">credential id</a>.</p>
         <li data-md>
          <p>Set <var>credentialSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id②">id</a> to <var>credentialId</var>.</p>
         <li data-md>
          <p>Let <var>credentials</var> be this authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map②">credentials map</a>.</p>
         <li data-md>
-         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set④">Set</a> <var>credentials</var>[(<code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code>, <var>userHandle</var>)] to <var>credentialSource</var>.</p>
+         <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑤">Set</a> <var>credentials</var>[(<code><var>rpEntity</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrpentity-id" id="ref-for-dom-publickeycredentialrpentity-id①③">id</a></code></code>, <var>userHandle</var>)] to <var>credentialSource</var>.</p>
        </ol>
       <li data-md>
        <p>Otherwise:</p>
@@ -4342,17 +4644,17 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
      <p>If any error occurred while creating the new credential object, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror①">UnknownError</a></code>" and
 terminate the operation.</p>
     <li data-md>
-     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑤">extension
+     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate③">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input②">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑦">authenticator</a>:</p>
+     <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a>:</p>
      <dl class="switch">
       <dt data-md>is a U2F device
       <dd data-md>
        <p>let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①④">signature counter</a> value for the new credential be zero. (U2F devices may support signature counters but do not return a counter when making a credential. See <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a>.)</p>
       <dt data-md>supports a global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⑤">signature counter</a>
       <dd data-md>
-       <p>Use the global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⑥">signature counter</a>'s actual value when generating <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑤">authenticator data</a>.</p>
+       <p>Use the global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⑥">signature counter</a>'s actual value when generating <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑦">authenticator data</a>.</p>
       <dt data-md>supports a per credential <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter①⑦">signature counter</a>
       <dd data-md>
        <p>allocate the counter, associate it with the new credential, and initialize the counter value as zero.</p>
@@ -4363,7 +4665,7 @@ <h4 class="heading settled" data-level="6.3.2" id="sctn-op-make-cred"><span clas
     <li data-md>
      <p>Let <var>attestedCredentialData</var> be the <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑧">attested credential data</a> byte array including the <var>credentialId</var> and <var>publicKey</var>.</p>
     <li data-md>
-     <p>Let <var>authenticatorData</var> <a data-link-type="dfn" href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure" id="ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">be the byte array</a> specified in <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a>, including <var>attestedCredentialData</var> as the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata⑤">attestedCredentialData</a></code> and <var>processedExtensions</var>, if any, as the <code><a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions⑤">extensions</a></code>.</p>
+     <p>Let <var>authenticatorData</var> <a data-link-type="dfn" href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure" id="ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">be the byte array</a> specified in <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a>, including <var>attestedCredentialData</var> as the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑤">attestedCredentialData</a></code> and <var>processedExtensions</var>, if any, as the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑤">extensions</a></code>.</p>
     <li data-md>
      <p>Create an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object⑧">attestation object</a> for the new credential using the procedure specified in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>, using an authenticator-chosen <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①">attestation statement format</a>, <var>authenticatorData</var>,
 and <var>hash</var>, as well as <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-enterprise" id="ref-for-dom-attestationconveyancepreference-enterprise③">taking into account</a></code> the value of <var>enterpriseAttestationPossible</var>. For more details on attestation, see <a href="#sctn-attestation">§ 6.5 Attestation</a>.</p>
@@ -4374,13 +4676,13 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
    <dl>
     <dt data-md><var>rpId</var>
     <dd data-md>
-     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③④">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the user agent and the client.</p>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑤">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the user agent and the client.</p>
     <dt data-md><var>hash</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">hash of the serialized client data</a>, provided by the client.</p>
+     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized client data</a>, provided by the client.</p>
     <dt data-md><var>allowCredentialDescriptorList</var>
     <dd data-md>
-     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list③">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①①">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨③">Relying Party</a> (possibly filtered
+     <p>An OPTIONAL <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list④">list</a> of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①③">PublicKeyCredentialDescriptor</a></code>s describing credentials acceptable to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a> (possibly filtered
 by the client), if any.</p>
     <dt data-md><var>requireUserPresence</var>
     <dd data-md>
@@ -4392,57 +4694,57 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
      <p>The <a data-link-type="dfn" href="#effective-user-verification-requirement-for-assertion" id="ref-for-effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</a>, a Boolean value provided by the client.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑧">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑥">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
-the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨④">Relying Party</a>, if any.</p>
+     <p>A <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⓪">CBOR</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①①">map</a> from <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension identifiers</a> to their <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input③">authenticator extension inputs</a>, created by the client based on
+the extensions requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Party</a>, if any.</p>
    </dl>
    <p class="note" role="note"><span>Note:</span> Before performing this operation, all other operations in progress in the <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session③">authenticator session</a> MUST be aborted by running the <a data-link-type="dfn" href="#authenticatorcancel" id="ref-for-authenticatorcancel①②">authenticatorCancel</a> operation.</p>
-   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑧">authenticator</a> MUST perform the following procedure:</p>
+   <p>When this method is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
      <p>Check if all the supplied parameters are syntactically well-formed and of the correct length. If not, return an error code
 equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#unknownerror" id="ref-for-unknownerror②">UnknownError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑧">public key credential sources</a>.</p>
+     <p>Let <var>credentialOptions</var> be a new empty <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-set" id="ref-for-ordered-set⑥">set</a> of <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤④">public key credential sources</a>.</p>
     <li data-md>
-     <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑦">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
+     <p>If <var>allowCredentialDescriptorList</var> was supplied, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">for each</a> <var>descriptor</var> of <var>allowCredentialDescriptorList</var>:</p>
      <ol>
       <li data-md>
-       <p>Let <var>credSource</var> be the result of <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up①">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑤">id</a></code></code> in this
+       <p>Let <var>credSource</var> be the result of <a data-link-type="dfn" href="#credential-id-looking-up" id="ref-for-credential-id-looking-up①">looking up</a> <code><var>descriptor</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> in this
 authenticator.</p>
       <li data-md>
-       <p>If <var>credSource</var> is not <code>null</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append③">append</a> it to <var>credentialOptions</var>.</p>
+       <p>If <var>credSource</var> is not <code>null</code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append④">append</a> it to <var>credentialOptions</var>.</p>
      </ol>
     <li data-md>
      <p>Otherwise (<var>allowCredentialDescriptorList</var> was not supplied), <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate④">for each</a> <var>key</var> → <var>credSource</var> of this
-authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map③">credentials map</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append④">append</a> <var>credSource</var> to <var>credentialOptions</var>.</p>
+authenticator’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map③">credentials map</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#set-append" id="ref-for-set-append⑤">append</a> <var>credSource</var> to <var>credentialOptions</var>.</p>
     <li data-md>
      <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-remove" id="ref-for-list-remove②⓪">Remove</a> any items from <var>credentialOptions</var> whose <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid③">rpId</a> is not equal to <var>rpId</var>.</p>
     <li data-md>
      <p>If <var>credentialOptions</var> is now empty, return an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①①">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source③⑨">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
+     <p>Prompt the user to select a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑤">public key credential source</a> <var>selectedCredential</var> from <var>credentialOptions</var>.
 Collect an <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑤">authorization gesture</a> confirming <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⓪">user consent</a> for using <var>selectedCredential</var>.
 The prompt for the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑥">authorization gesture</a> may be shown
-by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑦⑨">authenticator</a> if it has its own output capability, or by the user agent otherwise.</p>
+by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticator</a> if it has its own output capability, or by the user agent otherwise.</p>
      <p>If <var>requireUserVerification</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑦">authorization gesture</a> MUST include <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⓪">user verification</a>.</p>
      <p>If <var>requireUserPresence</var> is <code>true</code>, the <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑧">authorization gesture</a> MUST include a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①②">test of user presence</a>.</p>
      <p>If the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②①">consent</a>, return an error code equivalent to
 "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notallowederror" id="ref-for-notallowederror①②">NotAllowedError</a></code>" and terminate the operation.</p>
     <li data-md>
-     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑤">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑦">extension
+     <p>Let <var>processedExtensions</var> be the result of <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing①">authenticator extension processing</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑤">for each</a> supported <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑧">extension
 identifier</a> → <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input④">authenticator extension input</a> in <var>extensions</var>.</p>
     <li data-md>
      <p>Increment the credential associated <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⓪">signature counter</a> or the global <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②①">signature counter</a> value, depending on
-which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⓪">authenticator</a>, by some positive value.
-If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧①">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
+which approach is implemented by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticator</a>, by some positive value.
+If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">authenticator</a> does not implement a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②②">signature counter</a>, let the <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②③">signature counter</a> value remain constant at
 zero.</p>
     <li data-md>
      <p>Let <var>authenticatorData</var> <a data-link-type="dfn" href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure" id="ref-for-authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure①">be the byte array</a> specified in <a href="#sctn-authenticator-data">§ 6.1 Authenticator Data</a> including <var>processedExtensions</var>, if any, as
-the <code><a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions⑥">extensions</a></code> and excluding <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata⑥">attestedCredentialData</a></code>.</p>
+the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑥">extensions</a></code> and excluding <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑥">attestedCredentialData</a></code>.</p>
     <li data-md>
      <p>Let <var>signature</var> be the <a data-link-type="dfn" href="#assertion-signature" id="ref-for-assertion-signature⑧">assertion signature</a> of the concatenation <code><var>authenticatorData</var> || <var>hash</var></code> using the <a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey①">privateKey</a> of <var>selectedCredential</var> as shown in <a href="#fig-signature">Figure <span class="figure-num-following"></span></a>, below. A simple,
 undelimited
-concatenation is safe to use here because the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑥">authenticator data</a> describes its own length. The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">hash of the serialized
+concatenation is safe to use here because the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑧">authenticator data</a> describes its own length. The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①①">hash of the serialized
 client data</a> (which potentially has a variable length) is always the last element.</p>
      <figure id="fig-signature">
        <img src="images/fido-signature-formats-figure2.svg"> 
@@ -4458,7 +4760,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p><var>selectedCredential</var>.<a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id③">id</a>, if either a list of credentials
 (i.e., <var>allowCredentialDescriptorList</var>) of length 2 or greater was
 supplied by the client, or no such list was supplied.</p>
-       <p class="note" role="note"><span>Note:</span> If, within <var>allowCredentialDescriptorList</var>, the client supplied exactly one credential and it was successfully employed, then its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑦">credential ID</a> is not returned since the client already knows it. This saves transmitting these bytes over
+       <p class="note" role="note"><span>Note:</span> If, within <var>allowCredentialDescriptorList</var>, the client supplied exactly one credential and it was successfully employed, then its <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑨">credential ID</a> is not returned since the client already knows it. This saves transmitting these bytes over
         what may be a constrained connection in what is likely a common case.</p>
       <li data-md>
        <p><var>authenticatorData</var></p>
@@ -4469,7 +4771,7 @@ <h4 class="heading settled" data-level="6.3.3" id="sctn-op-get-assertion"><span
        <p class="note" role="note"><span>Note:</span> the returned <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle③">userHandle</a> value may be <code>null</code>, see: <a data-link-type="dfn" href="#assertioncreationdata-userhandleresult" id="ref-for-assertioncreationdata-userhandleresult④">userHandleResult</a>.</p>
      </ul>
    </ol>
-   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧②">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑦">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑤">Relying Party</a> that
+   <p>If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> cannot find any <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">credential</a> corresponding to the specified <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Party</a> that
 matches the specified criteria, it terminates the operation and returns an error.</p>
    <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="secno">6.3.4. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticatorcancel">authenticatorCancel</dfn> Operation</span><a class="self-link" href="#sctn-op-cancel"></a></h4>
    <p>This operation takes no input parameters and returns no result.</p>
@@ -4477,26 +4779,70 @@ <h4 class="heading settled" data-level="6.3.4" id="sctn-op-cancel"><span class="
 session. The authenticator stops prompting for, or accepting, any user input related to authorizing the canceled operation. The
 client ignores any further responses from the authenticator for the canceled operation.</p>
    <p>This operation is ignored if it is invoked in an <a data-link-type="dfn" href="#authenticator-session" id="ref-for-authenticator-session⑤">authenticator session</a> which does not have an <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑤">authenticatorMakeCredential</a> or <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑤">authenticatorGetAssertion</a> operation currently in progress.</p>
-   <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
-   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑥">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①③">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①②">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
-   <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
-   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧③">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-utr29">[UTR29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
-   <p>For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries①">grapheme cluster</a> an authenticator may remove the remainder of that cluster.</p>
-   <figure id="fig-stringTruncation">
-     <img src="images/string-truncation.svg"> 
-    <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
-   </figure>
-   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑦">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑧">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries②">grapheme cluster</a> boundaries.</p>
-   <p>Truncation based on UTF-8 sequences alone may cause a <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries③">grapheme cluster</a> to be truncated. This could make the grapheme cluster render as a different glyph, potentially changing the meaning of the string, instead of removing the glyph entirely.</p>
-   <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧④">authenticators</a>, user agents SHOULD:</p>
+   <h4 class="heading settled" data-level="6.3.5" id="sctn-op-silent-discovery"><span class="secno">6.3.5. </span><span class="content">The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="silentcredentialdiscovery">silentCredentialDiscovery</dfn> operation</span><a class="self-link" href="#sctn-op-silent-discovery"></a></h4>
+   <p>This is an OPTIONAL operation authenticators MAY support to enable <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional" id="ref-for-dom-credentialmediationrequirement-conditional①③">conditional</a></code> <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#user-mediated" id="ref-for-user-mediated⑥">user mediation</a>.</p>
+   <p>It takes the following input parameter:</p>
+   <dl>
+    <dt data-md><var>rpId</var>
+    <dd data-md>
+     <p>The caller’s <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a>, as <a href="#GetAssn-DetermineRpId">determined</a> by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a>.</p>
+   </dl>
+   <p>When this operation is invoked, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticator</a> MUST perform the following procedure:</p>
    <ol>
     <li data-md>
-     <p>Ensure that any strings sent to authenticators are validly encoded.</p>
-    <li data-md>
-     <p>Handle the case where strings have been truncated resulting in an invalid encoding. For example, any partial code point at the end may be dropped or replaced with <a href="http://unicode.org/cldr/utility/character.jsp?a=FFFD">U+FFFD</a>.</p>
+     <p>Let <var>collectedDiscoverableCredentialMetadata</var> be a new <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list" id="ref-for-list⑤">list</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①①">items</a> are <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata">DiscoverableCredentialMetadata</dfn> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct④">structs</a> with the following <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①⓪">items</a>:</p>
+     <dl>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-type">type</dfn>
+      <dd data-md>
+       <p>A <code class="idl"><a data-link-type="idl" href="#enumdef-publickeycredentialtype" id="ref-for-enumdef-publickeycredentialtype①①">PublicKeyCredentialType</a></code>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-id">id</dfn>
+      <dd data-md>
+       <p>A <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⓪">Credential ID</a>.</p>
+      <dt data-md>rpId
+      <dd data-md>
+       <p>A <a data-link-type="dfn" href="#relying-party-identifier" id="ref-for-relying-party-identifier④">Relying Party Identifier</a>.</p>
+      <dt data-md>userHandle
+      <dd data-md>
+       <p>A <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handle</a>.</p>
+      <dt data-md><dfn class="dfn-paneled" data-dfn-for="DiscoverableCredentialMetadata" data-dfn-type="dfn" data-noexport id="discoverablecredentialmetadata-otherui">otherUI</dfn>
+      <dd data-md>
+       <p>Other information used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> to inform its UI.</p>
+     </dl>
+    <li data-md>
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-iterate" id="ref-for-map-iterate⑥">For each</a> <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑥">public key credential source</a> <var>credSource</var> of <var>authenticator</var>’s <a data-link-type="dfn" href="#authenticator-credentials-map" id="ref-for-authenticator-credentials-map④">credentials map</a>:</p>
+     <ol>
+      <li data-md>
+       <p>If <var>credSource</var> is not a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑤">continue</a>.</p>
+      <li data-md>
+       <p>If <var>credSource</var>.<a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid④">rpId</a> is not <var>rpId</var>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑥">continue</a>.</p>
+      <li data-md>
+       <p>Let <var>discoveredCredentialMetadata</var> be a new <a data-link-type="dfn" href="#discoverablecredentialmetadata" id="ref-for-discoverablecredentialmetadata②">DiscoverableCredentialMetadata</a> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct" id="ref-for-struct⑤">struct</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#struct-item" id="ref-for-struct-item①①">items</a> are copies of <var>credSource</var>’s <a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type③">type</a>, <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id④">id</a>, <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑤">rpId</a>, <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle④">userHandle</a> and <a data-link-type="dfn" href="#public-key-credential-source-otherui" id="ref-for-public-key-credential-source-otherui③">otherUI</a>.</p>
+      <li data-md>
+       <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-append" id="ref-for-list-append③">Append</a> <var>discoveredCredentialMetadata</var> to <var>collectedDiscoverableCredentialMetadata</var>.</p>
+     </ol>
+    <li data-md>
+     <p>Return <var>collectedDiscoverableCredentialMetadata</var>.</p>
+   </ol>
+   <h3 class="heading settled" data-level="6.4" id="sctn-strings"><span class="secno">6.4. </span><span class="content">String Handling</span><a class="self-link" href="#sctn-strings"></a></h3>
+   <p>Authenticators may be required to store arbitrary strings chosen by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Party</a>, for example the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialentity-name" id="ref-for-dom-publickeycredentialentity-name①④">name</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-displayname" id="ref-for-dom-publickeycredentialuserentity-displayname①③">displayName</a></code> in a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑥">PublicKeyCredentialUserEntity</a></code>. This section discusses some practical consequences of handling arbitrary strings that may be presented to humans.</p>
+   <h4 class="heading settled" data-level="6.4.1" id="sctn-strings-truncation"><span class="secno">6.4.1. </span><span class="content">String Truncation</span><a class="self-link" href="#sctn-strings-truncation"></a></h4>
+   <p>Each arbitrary string in the API will have some accommodation for the potentially limited resources available to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a>. If string value truncation is the chosen accommodation then authenticators MAY truncate in order to make the string fit within a length equal or greater than the specified minimum supported length. Such truncation SHOULD also respect UTF-8 sequence boundaries or <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries">grapheme cluster</a> boundaries <a data-link-type="biblio" href="#biblio-utr29">[UTR29]</a>. This defines the maximum truncation permitted and authenticators MUST NOT truncate further.</p>
+   <p>For example, in <a href="#fig-stringTruncation">figure <span class="figure-num-following"></span></a> the string is 65 bytes long. If truncating to 64 bytes then the final 0x88 byte must be removed purely because of space reasons. Since that leaves a partial UTF-8 sequence the remainder of that sequence may also be removed. Since that leaves a partial <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries①">grapheme cluster</a> an authenticator may remove the remainder of that cluster.</p>
+   <figure id="fig-stringTruncation">
+     <img src="images/string-truncation.svg"> 
+    <figcaption>The end of a UTF-8 encoded string showing the positions of different truncation boundaries.</figcaption>
+   </figure>
+   <p><a data-link-type="dfn" href="#conforming-user-agent" id="ref-for-conforming-user-agent④">Conforming User Agents</a> are responsible for ensuring that the authenticator behavior observed by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> conforms to this specification with respect to string handling. For example, if an authenticator is known to behave incorrectly when asked to store large strings, the user agent SHOULD perform the truncation for it in order to maintain the model from the point of view of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Party</a>. User-agents that do this SHOULD truncate at <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries②">grapheme cluster</a> boundaries.</p>
+   <p>Truncation based on UTF-8 sequences alone may cause a <a data-link-type="dfn" href="https://unicode.org/reports/tr29/#Grapheme_Cluster_Boundaries" id="ref-for-Grapheme_Cluster_Boundaries③">grapheme cluster</a> to be truncated. This could make the grapheme cluster render as a different glyph, potentially changing the meaning of the string, instead of removing the glyph entirely.</p>
+   <p>In addition to that, truncating on byte boundaries alone causes a known issue that user agents should be aware of: if the authenticator is using <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> then future messages from the authenticator may contain invalid CBOR since the value is typed as a CBOR string and thus is required to be valid UTF-8. User agents are tasked with handling this to avoid burdening authenticators with understanding character encodings and Unicode character properties. Thus, when dealing with <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticators</a>, user agents SHOULD:</p>
+   <ol>
+    <li data-md>
+     <p>Ensure that any strings sent to authenticators are validly encoded.</p>
+    <li data-md>
+     <p>Handle the case where strings have been truncated resulting in an invalid encoding. For example, any partial code point at the end may be dropped or replaced with <a href="http://unicode.org/cldr/utility/character.jsp?a=FFFD">U+FFFD</a>.</p>
    </ol>
    <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span class="secno">6.4.2. </span><span class="content">Language and Direction Encoding</span><a class="self-link" href="#sctn-strings-langdir"></a></h4>
-   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑤">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
+   <p>In order to be correctly displayed in context, the language and base direction of a string <a href="https://www.w3.org/TR/string-meta/#why-is-this-important">may be required</a>. Strings in this API may have to be written to fixed-function <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticators</a> and then later read back and displayed on a different platform. Thus language and direction metadata is encoded in the string itself to ensure that it is transported atomically.</p>
    <p>To encode language and direction metadata in a string that is documented as permitting it, suffix its code points with two sequences of code points:</p>
    <p>The first encodes a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1">language tag</a> with the code point U+E0001 followed by the ASCII values of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1①">language tag</a> each shifted up by U+E0000. For example, the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1②">language tag</a> “en-US” becomes the code points U+E0001, U+E0065, U+E006E, U+E002D, U+E0055, U+E0053.</p>
    <p>The second consists of a single code point which is either U+200E (“LEFT-TO-RIGHT MARK”), U+200F (“RIGHT-TO-LEFT MARK”), or U+E007F (“CANCEL TAG”). The first two can be used to indicate directionality but SHOULD only be used when neccessary to produce the correct result. (E.g. an RTL string that starts with LTR-strong characters.) The value U+E007F is a direction-agnostic indication of the end of the <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1③">language tag</a>.</p>
@@ -4509,37 +4855,37 @@ <h4 class="heading settled" data-level="6.4.2" id="sctn-strings-langdir"><span c
    </ul>
    <p>Consumers of strings that may have language and direction encoded should be aware that truncation could truncate a <a data-link-type="dfn" href="https://tools.ietf.org/html/bcp47#section-2.1" id="ref-for-section-2.1④">language tag</a> into a different, but still valid, language. The final directionality marker or CANCEL TAG code point provide an unambigous indication of truncation.</p>
    <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="secno">6.5. </span><span class="content">Attestation</span><a class="self-link" href="#sctn-attestation"></a></h3>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑥">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>, if possible.
-If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑦">authenticator</a> can
-produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②③">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑦">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑤">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a> and
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">Authenticators</a> SHOULD also provide some form of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①①">attestation</a>, if possible.
+If an authenticator does, the basic requirement is that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a> can
+produce, for each <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②④">credential public key</a>, an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑧">attestation statement</a> verifiable by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a>. Typically, this <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> contains a signature by an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key①">attestation private key</a> over the attested <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> and
 a challenge, as well as a certificate or similar data providing provenance information for the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key">attestation public key</a>,
-enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party①⑨⑨">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
-MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑤">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private key</a>,
+enabling the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Party</a> to make a trust decision. However, if an <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair②">attestation key pair</a> is not available, then the authenticator
+MAY either perform <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑦">self attestation</a> of the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> with the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑦">credential private key</a>,
 or otherwise perform <a data-link-type="dfn" href="#none" id="ref-for-none①">no attestation</a>. All this
-information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑧">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑧">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑦">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement①⑨">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
-   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑧⑨">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
-for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⓪">Relying Party</a> to base a trust decision on.
-In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⓪">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪①">Relying Party</a>.</p>
+information is returned by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticators</a> any time a new <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> is generated, in the overall form of an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-object">attestation object</dfn>. The relationship of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⓪">attestation object</a> with <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data⑨">attested credential data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a> is illustrated in <a href="#fig-attStructs">figure <span class="figure-num-following"></span></a>, below.</p>
+   <p>If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticator</a> employs <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑧">self attestation</a> or <a data-link-type="dfn" href="#none" id="ref-for-none②">no attestation</a>, then no provenance information is provided
+for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> to base a trust decision on.
+In these cases, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticator</a> provides no guarantees about its operation to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a>.</p>
    <figure id="fig-attStructs">
      <img src="images/fido-attestation-structures.svg"> 
-    <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑧">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
-    data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⓪">attestation statement</a>.</figcaption>
+    <figcaption><a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①①">Attestation object</a> layout illustrating the included <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> (containing <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①⓪">attested credential
+    data</a>) and the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation statement</a>.</figcaption>
    </figure>
    <div class="note" role="note"> This figure illustrates only the <code>packed</code> <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format②">attestation statement format</a>. Several additional <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format③">attestation statement
   formats</a> are defined in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. </div>
    <p>An important component of the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①②">attestation object</a> is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement">attestation statement</dfn>. This is a specific type of signed
-data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential④⑨">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨①">authenticator</a> that created it. It
-contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑥">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
-attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②①">attestation
-statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪②">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a>:</p>
+data object, containing statements about a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> itself and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> that created it. It
+contains an <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a> created using the key of the attesting authority (except for the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation⑨">self
+attestation</a>, when it is created using the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑧">credential private key</a>). In order to correctly interpret an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation
+statement</a>, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Party</a> needs to understand these two aspects of <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①②">attestation</a>:</p>
    <ol>
     <li data-md>
      <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-statement-format">attestation statement format</dfn> is the manner in which the signature is represented and the various contextual
-bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨②">authenticator</a>. In other words, this defines the
+bindings are incorporated into the attestation statement by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticator</a>. In other words, this defines the
 syntax of the statement. Various existing components and OS platforms (such as TPMs and the Android OS) have previously defined <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format④">attestation statement formats</a>. This specification supports a variety of such formats in an extensible way, as defined in <a href="#sctn-attestation-formats">§ 6.5.2 Attestation Statement Formats</a>. The formats themselves are identified by strings, as described in <a href="#sctn-attstn-fmt-ids">§ 8.1 Attestation Statement Format Identifiers</a>.</p>
     <li data-md>
-     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②②">attestation statements</a> and their underlying trust models.
-Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪③">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statement</a>, after verifying that it
+     <p>The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-type">attestation type</dfn> defines the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②③">attestation statements</a> and their underlying trust models.
+Specifically, it defines how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Party</a> establishes trust in a particular <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statement</a>, after verifying that it
 is cryptographically valid. This specification supports a number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type">attestation types</a>, as described in <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>.</p>
    </ol>
    <p>In general, there is no simple mapping between <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑤">attestation statement formats</a> and <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①">attestation types</a>. For example, the
@@ -4551,17 +4897,17 @@ <h3 class="heading settled" data-level="6.5" id="sctn-attestation"><span class="
      <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type③">attestation type</a>, which determines the trust model,</p>
     <li data-md>
      <p>The <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑦">attestation statement format</a>, which MAY constrain the strength of the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①④">attestation</a> by limiting what can be
-expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②④">attestation statement</a>, and</p>
+expressed in an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a>, and</p>
     <li data-md>
-     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨③">authenticator</a>, such as its construction, whether part or all of it runs in a secure
+     <p>The characteristics of the individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a>, such as its construction, whether part or all of it runs in a secure
 operating environment, and so on.</p>
    </ul>
-   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨④">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪④">Relying Parties</a> can only signal limited <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> preferences during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑥">registration</a>.
-It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑤">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
-formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑤">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑥">Relying Parties</a> will also need to
-understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑥">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑦">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice">[FIDOMetadataService]</a> provides one way to access such information.</p>
+   <p>The <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type④">attestation type</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑧">attestation statement format</a> is chosen by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a>; <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Parties</a> can only signal limited <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance③">attestation conveyance</a> preferences during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a>.
+It is expected that most <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticators</a> will support a small number of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑤">attestation types</a> and <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format⑨">attestation statement
+formats</a>, while <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Parties</a> will decide what <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑥">attestation types</a> are acceptable to them by policy. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Parties</a> will also need to
+understand the characteristics of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticators</a> that they trust, based on information they have about these <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticators</a>. For example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice">[FIDOMetadataService]</a> provides one way to access such information.</p>
    <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data"><span class="secno">6.5.1. </span><span class="content">Attested Credential Data</span><a class="self-link" href="#sctn-attested-credential-data"></a></h4>
-   <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attested-credential-data">Attested credential data</dfn> is a variable-length byte array added to the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data③⑨">authenticator data</a> when generating an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①③">attestation
+   <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attested-credential-data">Attested credential data</dfn> is a variable-length byte array added to the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> when generating an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①③">attestation
 object</a> for a given credential. Its format is shown in <a href="#table-attestedCredentialData">Table <span class="table-ref-following"></span></a>.</p>
    <figure class="table" id="table-attestedCredentialData">
     <table class="complex data longlastcol">
@@ -4571,25 +4917,25 @@ <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data
        <th>Length (in bytes)
        <th>Description
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="aaguid">aaguid</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-aaguid">aaguid</dfn>
        <td>16
        <td>The AAGUID of the authenticator.
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credentialidlength">credentialIdLength</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-credentialidlength">credentialIdLength</dfn>
        <td>2
-       <td>Byte length <strong>L</strong> of <a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid③">credentialId</a>, 16-bit unsigned big-endian integer. Value MUST be ≤ 1023.
+       <td>Byte length <strong>L</strong> of <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid③">credentialId</a>, 16-bit unsigned big-endian integer. Value MUST be ≤ 1023.
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credentialid">credentialId</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-credentialid">credentialId</dfn>
        <td>L
-       <td><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑧">Credential ID</a>
+       <td><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③①">Credential ID</a>
       <tr>
-       <td><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credentialpublickey">credentialPublicKey</dfn>
+       <td><dfn class="dfn-paneled" data-dfn-for="authData/attestedCredentialData" data-dfn-type="dfn" data-noexport id="authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</dfn>
        <td>variable
-       <td> The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑥">credential public key</a> encoded in COSE_Key format,
+       <td> The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑦">credential public key</a> encoded in COSE_Key format,
                 as defined in <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7②">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a>, using the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#ctap2-canonical-cbor-encoding-form" id="ref-for-ctap2-canonical-cbor-encoding-form③">CTAP2 canonical CBOR encoding form</a>.
-                The COSE_Key-encoded <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑦">credential public key</a> MUST contain the "alg" parameter and MUST NOT
+                The COSE_Key-encoded <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑧">credential public key</a> MUST contain the "alg" parameter and MUST NOT
                 contain any other OPTIONAL parameters. The "alg" parameter MUST contain a <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①①">COSEAlgorithmIdentifier</a></code> value.
-                The encoded <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑧">credential public key</a> MUST also contain any additional REQUIRED parameters stipulated by the
+                The encoded <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑨">credential public key</a> MUST also contain any additional REQUIRED parameters stipulated by the
                 relevant key type specification, i.e., REQUIRED for the key type "kty" and algorithm "alg" (see Section 8 of <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a>). 
     </table>
     <figcaption> <a data-link-type="dfn" href="#attested-credential-data" id="ref-for-attested-credential-data①①">Attested credential data</a> layout. The names in the Name column are only for reference within this document, and are not
@@ -4597,7 +4943,7 @@ <h4 class="heading settled" data-level="6.5.1" id="sctn-attested-credential-data
    </figure>
    <h5 class="heading settled" data-level="6.5.1.1" id="sctn-encoded-credPubKey-examples"><span class="secno">6.5.1.1. </span><span class="content">Examples of <code>credentialPublicKey</code> Values Encoded in COSE_Key Format</span><a class="self-link" href="#sctn-encoded-credPubKey-examples"></a></h5>
    <p>This section provides examples of COSE_Key-encoded Elliptic Curve and RSA public keys for the ES256, PS256, and RS256
-signature algorithms. These examples adhere to the rules defined above for the <a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey④">credentialPublicKey</a> value, and are presented in CDDL <a data-link-type="biblio" href="#biblio-rfc8610">[RFC8610]</a> for clarity.</p>
+signature algorithms. These examples adhere to the rules defined above for the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey④">credentialPublicKey</a> value, and are presented in CDDL <a data-link-type="biblio" href="#biblio-rfc8610">[RFC8610]</a> for clarity.</p>
    <p><a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7③">Section 7</a> defines the general framework for all COSE_Key-encoded keys.
 Specific key types for specific algorithms are defined in other sections of <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a> as well as in other specifications,
 as noted below.</p>
@@ -4650,7 +4996,7 @@ <h5 class="heading settled" data-level="6.5.1.1" id="sctn-encoded-credPubKey-exa
 <c- p>}</c->
 </pre>
    <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><span class="secno">6.5.2. </span><span class="content">Attestation Statement Formats</span><a class="self-link" href="#sctn-attestation-formats"></a></h4>
-   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑧">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> MUST be defined using the following
+   <p>As described above, an <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⓪">attestation statement format</a> is a data format which represents a cryptographic signature by an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> over a set of contextual bindings. Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①①">attestation statement format</a> MUST be defined using the following
 template:</p>
    <ul>
     <li data-md>
@@ -4658,22 +5004,22 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
     <li data-md>
      <p><strong>Supported <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑦">attestation types</a>:</strong></p>
     <li data-md>
-     <p><strong>Syntax:</strong> The syntax of an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑤">attestation statement</a> produced in this format, defined using CDDL <a data-link-type="biblio" href="#biblio-rfc8610">[RFC8610]</a> for the extension point <code>$attStmtFormat</code> defined in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>.</p>
+     <p><strong>Syntax:</strong> The syntax of an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a> produced in this format, defined using CDDL <a data-link-type="biblio" href="#biblio-rfc8610">[RFC8610]</a> for the extension point <code>$attStmtFormat</code> defined in <a href="#sctn-generating-an-attestation-object">§ 6.5.4 Generating an Attestation Object</a>.</p>
     <li data-md>
      <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="signing-procedure">Signing procedure</dfn>:
-The <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure②">signing procedure</a> for computing an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑥">attestation statement</a> in this <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">format</a> given
-the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⓪">public key credential</a> to be attested, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⓪">authenticator data</a> structure containing the <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="authenticator data for the attestation" data-noexport id="authenticator-data-for-the-attestation">authenticator data
-for the attestation</dfn>, and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①①">hash of the serialized client data</a>.</p>
+The <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure②">signing procedure</a> for computing an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a> in this <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①②">format</a> given
+the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤①">public key credential</a> to be attested, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④②">authenticator data</a> structure containing the <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="authenticator data for the attestation" data-noexport id="authenticator-data-for-the-attestation">authenticator data
+for the attestation</dfn>, and the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①②">hash of the serialized client data</a>.</p>
     <li data-md>
      <p><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure">Verification procedure</dfn>:
-The procedure for verifying an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑦">attestation statement</a>, which takes the following <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure-inputs">verification procedure inputs</dfn>:</p>
+The procedure for verifying an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a>, which takes the following <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="verification-procedure-inputs">verification procedure inputs</dfn>:</p>
      <ul>
       <li data-md>
-       <p><var>attStmt</var>: The <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑧">attestation statement</a> structure</p>
+       <p><var>attStmt</var>: The <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑨">attestation statement</a> structure</p>
       <li data-md>
-       <p><var>authenticatorData</var>: The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data-claimed-to-have-been-used-for-the-attestation"><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④①">authenticator data</a> claimed to have been used for the attestation</dfn></p>
+       <p><var>authenticatorData</var>: The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-data-claimed-to-have-been-used-for-the-attestation"><a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④③">authenticator data</a> claimed to have been used for the attestation</dfn></p>
       <li data-md>
-       <p><var>clientDataHash</var>: The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①②">hash of the serialized client data</a></p>
+       <p><var>clientDataHash</var>: The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①③">hash of the serialized client data</a></p>
      </ul>
      <p>The procedure returns either:</p>
      <ul>
@@ -4686,14 +5032,14 @@ <h4 class="heading settled" data-level="6.5.2" id="sctn-attestation-formats"><sp
    </ul>
    <p>The initial list of specified <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①③">attestation statement formats</a> is in <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>.</p>
    <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span class="secno">6.5.3. </span><span class="content">Attestation Types</span><a class="self-link" href="#sctn-attestation-types"></a></h4>
-   <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement②⑨">attestation statements</a> and their underlying trust
+   <p>WebAuthn supports several <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type⑨">attestation types</a>, defining the semantics of <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⓪">attestation statements</a> and their underlying trust
 models:</p>
-   <p class="note" role="note"><span>Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator①⑨⑨">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑦">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⓪">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
-calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②②">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none③">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
-section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑧">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
+   <p class="note" role="note"><span>Note:</span> This specification does not define any data structures explicitly expressing the <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⓪">attestation types</a> employed by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticators</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Parties</a> engaging in <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③①">attestation statement</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure">verification</a> — i.e., when
+calling <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">navigator.credentials.create()</a></code> they select an <a data-link-type="dfn" href="#attestation-conveyance" id="ref-for-attestation-conveyance④">attestation conveyance</a> other than <code class="idl"><a data-link-type="idl" href="#dom-attestationconveyancepreference-none" id="ref-for-dom-attestationconveyancepreference-none③">none</a></code> and verify the received <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statement</a> — will determine the employed <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①①">attestation type</a> as a part of <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure①">verification</a>. See the "Verification procedure" subsections of <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a>. See also <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. For all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①②">attestation types</a> defined in this
+section other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①①">Self</a> and <a data-link-type="dfn" href="#none" id="ref-for-none③">None</a>, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure②">verification</a> is followed by
 matching the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path①">trust path</a> to an acceptable root certificate per step 20 of <a href="#sctn-registering-a-new-credential">§ 7.1 Registering a New Credential</a>.
 Differentiating these <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①③">attestation types</a> becomes useful primarily as a means for determining if the <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑤">attestation</a> is acceptable
-under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⓪⑨">Relying Party</a> policy.</p>
+under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a> policy.</p>
    <dl>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic-attestation">Basic Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="basic">Basic</dfn>)
     <dd data-md>
@@ -4703,24 +5049,24 @@ <h4 class="heading settled" data-level="6.5.3" id="sctn-attestation-types"><span
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="self-attestation">Self Attestation</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="self">Self</dfn>)
     <dd data-md>
      <p>In the case of <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①②">self attestation</a>, also known as surrogate basic attestation <a data-link-type="biblio" href="#biblio-uafprotocol">[UAFProtocol]</a>, the Authenticator does not have
-any specific <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑤">attestation key pair</a>. Instead it uses the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private key</a> to create the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑦">attestation signature</a>.
+any specific <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑤">attestation key pair</a>. Instead it uses the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key①⑨">credential private key</a> to create the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑧">attestation signature</a>.
 Authenticators without meaningful protection measures for an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key②">attestation private key</a> typically use this attestation type.</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attestation-ca">Attestation CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="attca">AttCA</dfn>)
     <dd data-md>
-     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⓪">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
-"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪①">authenticator</a> can generate multiple
+     <p>In this case, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticator</a> is based on a Trusted Platform Module (TPM) and holds an authenticator-specific
+"endorsement key" (EK). This key is used to securely communicate with a trusted third party, the <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca①">Attestation CA</a> <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll">[TCG-CMCProfile-AIKCertEnroll]</a> (formerly known as a "Privacy CA"). The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a> can generate multiple
 attestation identity key pairs (AIK) and requests an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca②">Attestation CA</a> to issue an AIK certificate
-for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪②">authenticator</a> can limit the exposure of the EK (which is a global correlation
-handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪③">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤①">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⓪">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
+for each. Using this approach, such an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a> can limit the exposure of the EK (which is a global correlation
+handle) to Attestation CA(s). AIKs can be requested for each <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>-generated <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> individually, and conveyed to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Parties</a> as <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate③">attestation certificates</a>.</p>
      <p class="note" role="note"><span>Note:</span> This concept typically leads to multiple attestation certificates. The attestation certificate requested most recently
     is called "active".</p>
     <dt data-md><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonymization-ca">Anonymization CA</dfn> (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="anonca">AnonCA</dfn>)
     <dd data-md>
-     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪④">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③②">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①①">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
-     <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
+     <p>In this case, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> uses an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca③">Anonymization CA</a> which dynamically generates per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑥">credential</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate④">attestation certificates</a> such that the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③③">attestation statements</a> presented to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Parties</a> do not provide uniquely identifiable information, e.g., that might be used for tracking purposes.</p>
+     <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">Attestation statements</a> conveying <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑥">attestations</a> of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①④">type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca">AttCA</a> or <a data-link-type="dfn" href="#anonca" id="ref-for-anonca">AnonCA</a> use the same data structure
     as those of <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑤">type</a> <a data-link-type="dfn" href="#basic" id="ref-for-basic">Basic</a>, so the three attestation types
     are, in general, distinguishable only with externally provided knowledge regarding the contents of the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑤">attestation
-    certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③④">attestation statement</a>.</p>
+    certificates</a> conveyed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">attestation statement</a>.</p>
     <dt data-md>No attestation statement (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="none">None</dfn>)
     <dd data-md>
      <p>In this case, no attestation information is available. See also <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a>.</p>
@@ -4733,12 +5079,12 @@ <h4 class="heading settled" data-level="6.5.4" id="sctn-generating-an-attestatio
      <p>An <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①④">attestation statement format</a>.</p>
     <dt data-md><var>authData</var>
     <dd data-md>
-     <p>A byte array containing <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④②">authenticator data</a>.</p>
+     <p>A byte array containing <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④④">authenticator data</a>.</p>
     <dt data-md><var>hash</var>
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①③">hash of the serialized client data</a>.</p>
+     <p>The <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">hash of the serialized client data</a>.</p>
    </dl>
-   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑤">authenticator</a> MUST:</p>
+   <p>the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a> MUST:</p>
    <ol>
     <li data-md>
      <p>Let <var>attStmt</var> be the result of running <var>attestationFormat</var>’s <a data-link-type="dfn" href="#signing-procedure" id="ref-for-signing-procedure①">signing procedure</a> given <var>authData</var> and <var>hash</var>.</p>
@@ -4774,7 +5120,7 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
     |  4e 72 23 6e a3 90 a9 a1  7b cf 5f 7a 09 d6 3a b2
     |  17 6c 92 bb 8e 36 c0 41  98 a2 7b 90 9b 6e 8f 13
 </pre>
-     <p class="note" role="note"><span>Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑥">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑦">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
+     <p class="note" role="note"><span>Note:</span> As CTAP1/U2F <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticators</a> are already producing signatures values in this format, CTAP2 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticators</a> will also produce signatures values in the same format, for consistency reasons.</p>
    </ul>
    <p>It is RECOMMENDED that any new attestation formats defined not use ASN.1 encodings,
     but instead represent signatures as equivalent fixed-length byte arrays without internal structure,
@@ -4790,33 +5136,33 @@ <h4 class="heading settled" data-level="6.5.5" id="sctn-signature-attestation-ty
 RSASSA-PSS signature scheme defined in section 8.1.1 in <a data-link-type="biblio" href="#biblio-rfc8017">[RFC8017]</a> with SHA-256 as the hash function.
 The signature is not ASN.1 wrapped.</p>
    </ul>
-   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑥">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
-   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑧">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑦">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions④">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑤">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⓪">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①②">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
-   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②③">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑦">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①③">Relying Party</a>'s script receives
-a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⓪">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
-respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①④">Relying Party</a> server, using methods outside
-the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑤">Relying Party</a> must perform upon receipt of these
+   <h2 class="heading settled" data-level="7" id="sctn-rp-operations"><span class="secno">7. </span><span class="content"><a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> Operations</span><a class="self-link" href="#sctn-rp-operations"></a></h2>
+   <p>A <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑦">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication ceremony</a> begins with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> creating a <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑧">PublicKeyCredentialCreationOptions</a></code> or <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①①">PublicKeyCredentialRequestOptions</a></code> object, respectively, which encodes the parameters for the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a> SHOULD take care to not leak sensitive information during this stage; see <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> for details.</p>
+   <p>Upon successful execution of <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a>'s script receives
+a <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②④">PublicKeyCredential</a></code> containing an <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑤">AuthenticatorAttestationResponse</a></code> or <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑥">AuthenticatorAssertionResponse</a></code> structure,
+respectively, from the client. It must then deliver the contents of this structure to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> server, using methods outside
+the scope of this specification. This section describes the operations that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> must perform upon receipt of these
 structures.</p>
    <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credential"><span class="secno">7.1. </span><span class="content">Registering a New Credential</span><a class="self-link" href="#sctn-registering-a-new-credential"></a></h3>
-   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑥">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑧">registration ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑤">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑦">Relying Party</a>'s needs for the ceremony.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑨">PublicKeyCredentialCreationOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
-     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②④">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
+     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">navigator.credentials.create()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialcreationoptions-publickey" id="ref-for-dom-credentialcreationoptions-publickey④">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as
 might be determinable from the context available in the rejected promise. For example if the promise is rejected with
-an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑧">authenticator</a>.
+an error code equivalent to "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#invalidstateerror" id="ref-for-invalidstateerror④">InvalidStateError</a></code>", the user might be instructed to use a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a>.
 For information on different error contexts and the circumstances leading to them, see <a href="#sctn-op-make-cred">§ 6.3.2 The authenticatorMakeCredential Operation</a>.</p>
     <li data-md>
      <p>Let <var>response</var> be <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑤">response</a></code></code>.
 If <var>response</var> is not an instance of <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑥">AuthenticatorAttestationResponse</a></code>, abort the ceremony with a user-visible error.</p>
     <li data-md>
-     <p>Let <var>clientExtensionResults</var> be the result of calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults①">getClientExtensionResults()</a></code></code>.</p>
+     <p>Let <var>clientExtensionResults</var> be the result of calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults②">getClientExtensionResults()</a></code></code>.</p>
     <li data-md>
      <p>Let <var>JSONtext</var> be the result of
-running <a data-link-type="dfn" href="https://encoding.spec.whatwg.org/#utf-8-decode" id="ref-for-utf-8-decode">UTF-8 decode</a> on the value of <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑥">clientDataJSON</a></code></code>.</p>
+running <a data-link-type="dfn" href="https://encoding.spec.whatwg.org/#utf-8-decode" id="ref-for-utf-8-decode">UTF-8 decode</a> on the value of <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑦">clientDataJSON</a></code></code>.</p>
      <p class="note" role="note"><span>Note:</span> Using any implementation of <a data-link-type="dfn" href="https://encoding.spec.whatwg.org/#utf-8-decode" id="ref-for-utf-8-decode①">UTF-8 decode</a> is acceptable as long as it yields the same result as that yielded by
 the <a data-link-type="dfn" href="https://encoding.spec.whatwg.org/#utf-8-decode" id="ref-for-utf-8-decode②">UTF-8 decode</a> algorithm. In particular, any leading byte order mark (BOM) MUST be stripped.</p>
     <li data-md>
@@ -4830,34 +5176,33 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑥">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge②">challenge</a></code></code>.</p>
     <li data-md>
-     <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑧">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a>.</p>
+     <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑦">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①③">origin</a>.</p>
     <li data-md>
-     <p>Let <var>hash</var> be the result of computing a hash over <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑦">clientDataJSON</a></code></code> using SHA-256.</p>
+     <p>Let <var>hash</var> be the result of computing a hash over <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑧">clientDataJSON</a></code></code> using SHA-256.</p>
     <li data-md>
-     <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑥">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④③">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
+     <p>Perform CBOR decoding on the <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑦">attestationObject</a></code> field of the <code class="idl"><a data-link-type="idl" href="#authenticatorattestationresponse" id="ref-for-authenticatorattestationresponse⑦">AuthenticatorAttestationResponse</a></code> structure to obtain the attestation statement format <var>fmt</var>, the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑤">authenticator data</a> <var>authData</var>, and the attestation statement <var>attStmt</var>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#rpidhash" id="ref-for-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑤">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②①⑨">Relying Party</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash②">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a>.</p>
     <li data-md>
-     <p>Verify that the <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">User Present</a> bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags②⑦">flags</a></code> in <var>authData</var> is set.</p>
+     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up③">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⓪">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⓪">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> for this registration,
-verify that the <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">User Verified</a> bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags②⑧">flags</a></code> in <var>authData</var> is set.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④①">user verification</a> for this registration,
+verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑦">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③①">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②①">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility④">backup eligibility</a> (BE) bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags②⑨">flags</a></code> in <var>authData</var>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-eligibility" id="ref-for-backup-eligibility③">backup eligibility</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑥">BE</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③②">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②②">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> (BS)
-bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags③⓪">flags</a></code> in <var>authData</var>, and then store the value for evaluation in future <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony①⑨">authentication ceremonies</a>.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> uses the credential’s <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state③">backup state</a> to inform its user experience flows and/or policies, evaluate the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑦">BS</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③③">flags</a></code> in <var>authData</var>.</p>
     <li data-md>
-     <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item⑨">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
+     <p>Verify that the "alg" parameter in the <a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">credential public key</a> in <var>authData</var> matches the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialparameters-alg" id="ref-for-dom-publickeycredentialparameters-alg②">alg</a></code> attribute of one of the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①②">items</a> in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-pubkeycredparams" id="ref-for-dom-publickeycredentialcreationoptions-pubkeycredparams④">pubKeyCredParams</a></code></code>.</p>
     <li data-md>
      <p>Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑥">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output③">authenticator extension
-outputs</a> in the <code><a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input③">client
-extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②③">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
-In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②④">Relying Party</a> and which extensions are in use.</p>
-     <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④④">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension②">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑤">Relying Parties</a> MUST be prepared to handle such
-situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑥">Relying Party</a> can make this
+outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑦">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client
+extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑤">extensions</a></code></code>.
+In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> and which extensions are in use.</p>
+     <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension②">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output④">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑦">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Parties</a> MUST be prepared to handle such
+situations, whether it be to ignore the unsolicited extensions or reject the attestation. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Party</a> can make this
 decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span>Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑦①">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⓪⑨">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑦">Relying Party</a> MUST also be
+     <p class="note" role="note"><span>Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a> MUST also be
 prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
     <li data-md>
      <p>Determine the attestation statement format by performing a USASCII case-sensitive match on <var>fmt</var> against the set of
@@ -4866,98 +5211,113 @@ <h3 class="heading settled" data-level="7.1" id="sctn-registering-a-new-credenti
 is maintained in the
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>.</p>
     <li data-md>
-     <p>Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑤">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑧">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure③">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>.</p>
+     <p>Verify that <var>attStmt</var> is a correct <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statement</a>, conveying a valid <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑨">attestation signature</a>, by using the <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑤">attestation statement format</a> <var>fmt</var>’s <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure③">verification procedure</a> given <var>attStmt</var>, <var>authData</var> and <var>hash</var>.</p>
      <p class="note" role="note"><span>Note:</span> Each <a data-link-type="dfn" href="#attestation-statement-format" id="ref-for-attestation-statement-format①⑥">attestation statement format</a> specifies its own <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure④">verification procedure</a>. See <a href="#sctn-defined-attestation-formats">§ 8 Defined Attestation Statement Formats</a> for
 the initially-defined formats, and <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> for the up-to-date list.</p>
     <li data-md>
      <p>If validation is successful, obtain a list of acceptable trust anchors (i.e. attestation root certificates)
 for that attestation type and attestation statement format <var>fmt</var>, from a trusted source or from policy. For
-example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑥">aaguid</a></code> in the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>.</p>
+example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice">[FIDOMetadataService]</a> provides one way to obtain such information, using the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑥">aaguid</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑦">attestedCredentialData</a></code> in <var>authData</var>.</p>
     <li data-md>
      <p>Assess the attestation trustworthiness using the outputs of the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑤">verification procedure</a> in step 19, as follows:</p>
      <ul>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑧">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#none" id="ref-for-none④">no attestation</a> was provided, verify that <a data-link-type="dfn" href="#none" id="ref-for-none⑤">None</a> attestation is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Party</a> policy.</p>
       <li data-md>
-       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②②⑨">Relying Party</a> policy.</p>
+       <p>If <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①③">self attestation</a> was used, verify that <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①④">self attestation</a> is acceptable under <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> policy.</p>
       <li data-md>
        <p>Otherwise, use the X.509 certificates returned as the <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path②">attestation trust path</a> from the <a data-link-type="dfn" href="#verification-procedure" id="ref-for-verification-procedure⑥">verification procedure</a> to verify that the attestation public key either correctly chains up to an acceptable root certificate, or is itself an acceptable certificate (i.e., it and the root certificate obtained in Step 19 may be the same).</p>
      </ul>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration ceremony</a>.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid④">credentialId</a></code> is ≤ 1023 bytes. Credential IDs larger than this many bytes SHOULD cause the RP to fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony⑨">registration ceremony</a>.</p>
     <li data-md>
-     <p>Verify that the <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⓪">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>.</p>
-     <p class="note" role="note"><span>NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③①">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id②⑨">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⓪">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑦">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③①">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key②⑨">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③②">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
+     <p>Verify that the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑤">credentialId</a></code> is not yet registered for any user. If the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialid" id="ref-for-authdata-attestedcredentialdata-credentialid⑥">credentialId</a></code> is already known then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> SHOULD fail this <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⓪">registration ceremony</a>.</p>
+     <p class="note" role="note"><span>NOTE:</span> The rationale for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Parties</a> rejecting duplicate <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential IDs</a> is as follows: <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential IDs</a> contain sufficient entropy that accidental duplication is very unlikely. However, <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑥">attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑤">self attestation</a> do not include a self-signature to explicitly prove possession of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⓪">credential private key</a> at <a data-link-type="dfn" href="#registration" id="ref-for-registration②⓪">registration</a> time. Thus an attacker who has managed to obtain a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential ID</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> for a site (this could be potentially accomplished in various ways), could attempt to register a victim’s credential as their own at that site. If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Party</a> accepts this new registration and replaces the victim’s existing credential registration, and the <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①①">credentials are discoverable</a>, then the victim could be forced to sign into the attacker’s account at their next attempt. Data saved to the site by the victim in that state would then be available to the attacker.</p>
     <li data-md>
-     <p>If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy, then register the new
-credential with the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account②⑨">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>:</p>
-     <ul>
-      <li data-md>
-       <p>Associate the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⓪">user account</a> with the <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid⑦">credentialId</a></code> and <code><a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey⑥">credentialPublicKey</a></code> in <code><var>authData</var>.<a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata⑧">attestedCredentialData</a></code>, as appropriate for the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③③">Relying Party</a>'s system.</p>
-      <li data-md>
-       <p>Associate the <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid⑧">credentialId</a></code> with a new stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> value
-initialized to the value of <code><var>authData</var>.<a data-link-type="dfn" href="#signcount" id="ref-for-signcount④">signCount</a></code>.</p>
-     </ul>
-     <p>It is RECOMMENDED to also:</p>
-     <ul>
-      <li data-md>
-       <p>Associate the <code><a data-link-type="dfn" href="#credentialid" id="ref-for-credentialid⑨">credentialId</a></code> with the transport hints
-returned by calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑥">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports④">getTransports()</a></code></code>.
-This value SHOULD NOT be modified before or after storing it.
-It is RECOMMENDED to use this value to populate the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①①">transports</a></code> of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">allowCredentials</a></code> option in future <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑧">get()</a></code> calls
-to help the <a data-link-type="dfn" href="#client" id="ref-for-client⑦②">client</a> know how to find a suitable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⓪">authenticator</a>.</p>
-     </ul>
+     <p>If the attestation statement <var>attStmt</var> verified successfully and is found to be trustworthy,
+then create and store a new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑥">credential record</a> in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account</a> that was denoted in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑥">user</a></code></code>,
+with the following contents:</p>
+     <dl>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-type" id="ref-for-credential-record-type①">type</a>
+      <dd data-md>
+       <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type" id="ref-for-dom-credential-type②">type</a></code></code>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-id" id="ref-for-credential-record-id①">id</a>
+      <dd data-md>
+       <p><code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>,
+whichever format is preferred by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-publickey" id="ref-for-credential-record-publickey">publicKey</a>
+      <dd data-md>
+       <p>The <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a> in <var>authData</var>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-signcount" id="ref-for-credential-record-signcount">signCount</a>
+      <dd data-md>
+       <p><code><var>authData</var>.<a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount⑤">signCount</a></code>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-transports" id="ref-for-credential-record-transports①">transports</a>
+      <dd data-md>
+       <p>The value returned from <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑦">getTransports()</a></code></code>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-be" id="ref-for-credential-record-be">BE</a>
+      <dd data-md>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑦">BE</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③④">flag</a> in <var>authData</var>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-bs" id="ref-for-credential-record-bs">BS</a>
+      <dd data-md>
+       <p>The value of the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑧">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑤">flag</a> in <var>authData</var>.</p>
+     </dl>
+     <p>The new <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑦">credential record</a> MAY also include the following OPTIONAL contents:</p>
+     <dl>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-attestationobject" id="ref-for-credential-record-attestationobject①">attestationObject</a>
+      <dd data-md>
+       <p><code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-attestationobject" id="ref-for-dom-authenticatorattestationresponse-attestationobject⑧">attestationObject</a></code></code>.</p>
+      <dt data-md><a data-link-type="dfn" href="#credential-record-attestationclientdatajson" id="ref-for-credential-record-attestationclientdatajson">attestationClientDataJSON</a>
+      <dd data-md>
+       <p><code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑨">clientDataJSON</a></code></code>.</p>
+     </dl>
     <li data-md>
-     <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per step 20 above, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③④">Relying Party</a> SHOULD fail
+     <p>If the attestation statement <var>attStmt</var> successfully verified but is not trustworthy per step 20 above, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a> SHOULD fail
 the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①①">registration ceremony</a>.</p>
-     <p class="note" role="note"><span>NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑤">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③②">credential ID</a> and credential public key but treat the
-    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑥">Relying Party</a> is asserting there
-    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤②">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①①">authenticator</a> model.
+     <p class="note" role="note"><span>NOTE:</span> However, if permitted by policy, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a> MAY register the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential ID</a> and credential public key but treat the
+    credential as one with <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑥">self attestation</a> (see <a href="#sctn-attestation-types">§ 6.5.3 Attestation Types</a>). If doing so, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> is asserting there
+    is no cryptographic proof that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credential</a> has been generated by a particular <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> model.
     See <a data-link-type="biblio" href="#biblio-fidosecref">[FIDOSecRef]</a> and <a data-link-type="biblio" href="#biblio-uafprotocol">[UAFProtocol]</a> for a more detailed discussion.</p>
    </ol>
-   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑦">Relying Party</a> has a trusted method of determining acceptable trust anchors
-in step 19 above. Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑧">Relying Party</a> MUST have access to certificate status information for the
-intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②③⑨">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
+   <p>Verification of <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑥">attestation objects</a> requires that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> has a trusted method of determining acceptable trust anchors
+in step 19 above. Also, if certificates are being used, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> MUST have access to certificate status information for the
+intermediate CA certificates. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Party</a> MUST also be able to build the attestation certificate chain if the client did not
 provide this chain in the attestation information.</p>
    <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span class="secno">7.2. </span><span class="content">Verifying an Authentication Assertion</span><a class="self-link" href="#sctn-verifying-assertion"></a></h3>
-   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⓪">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⓪">Relying Party</a> MUST proceed as follows:</p>
+   <p>In order to perform an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> MUST proceed as follows:</p>
    <ol>
     <li data-md>
-     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑥">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④①">Relying Party</a>'s needs for the ceremony.</p>
-     <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①④">allowCredentials</a></code></code> is present,
-the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-transports" id="ref-for-dom-publickeycredentialdescriptor-transports①②">transports</a></code> member of each <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①⓪">item</a> SHOULD be set to
-the value that was returned by <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑦">response</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑤">getTransports()</a></code></code> when the corresponding credential was registered.</p>
-     <p class="note" role="note"><span>Note:</span> Modifying or removing <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-item" id="ref-for-list-item①①">items</a> from values returned from <code class="idl"><a data-link-type="idl" href="#dom-authenticatorattestationresponse-gettransports" id="ref-for-dom-authenticatorattestationresponse-gettransports⑥">getTransports()</a></code> could negatively impact user experience, or even prevent use of the corresponding credentials.</p>
+     <p>Let <var>options</var> be a new <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①②">PublicKeyCredentialRequestOptions</a></code> structure configured to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a>'s needs for the ceremony.</p>
     <li data-md>
-     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey④">publicKey</a></code></code> option.
+     <p>Call <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get②⑨">navigator.credentials.get()</a></code> and pass <var>options</var> as the <code><code class="idl"><a data-link-type="idl" href="#dom-credentialrequestoptions-publickey" id="ref-for-dom-credentialrequestoptions-publickey⑥">publicKey</a></code></code> option.
 Let <var>credential</var> be the result of the successfully resolved promise.
 If the promise is rejected, abort the ceremony with a user-visible error, or otherwise guide the user experience as might
 be determinable from the context available in the rejected promise. For information on different error contexts and the
 circumstances leading to them, see <a href="#sctn-op-get-assertion">§ 6.3.3 The authenticatorGetAssertion Operation</a>.</p>
     <li data-md>
-     <p>Let <var>response</var> be <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑧">response</a></code></code>.
+     <p>Let <var>response</var> be <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-response" id="ref-for-dom-publickeycredential-response⑥">response</a></code></code>.
 If <var>response</var> is not an instance of <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑦">AuthenticatorAssertionResponse</a></code>, abort the ceremony with a user-visible error.</p>
     <li data-md>
-     <p>Let <var>clientExtensionResults</var> be the result of calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults②">getClientExtensionResults()</a></code></code>.</p>
+     <p>Let <var>clientExtensionResults</var> be the result of calling <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults③">getClientExtensionResults()</a></code></code>.</p>
     <li data-md>
      <p>If <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤">allowCredentials</a></code></code> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-is-empty" id="ref-for-list-is-empty⑨">is not empty</a>,
-verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id①">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤③">public key credentials</a> listed in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code></code>.</p>
+verify that <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code> identifies one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">public key credentials</a> listed in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">allowCredentials</a></code></code>.</p>
     <li data-md>
-     <p>Identify the user being authenticated and verify that this user is the owner of the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⓪">public key credential source</a> <var>credentialSource</var> identified by <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id②">id</a></code></code>:</p>
+     <p>Identify the user being authenticated and let <var>credentialRecord</var> be the <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑧">credential record</a> for the <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a>:</p>
      <dl class="switch">
-      <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②①">authentication ceremony</a> was initiated, e.g., via a username or cookie,
+      <dt data-md>If the user was identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication ceremony</a> was initiated, e.g., via a username or cookie,
       <dd data-md>
-       <p>verify that the identified user is the owner of <var>credentialSource</var>. If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑥">userHandle</a></code></code> is present,
-let <var>userHandle</var> be its value. Verify that <var>userHandle</var> also maps to the same user.</p>
-      <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②②">authentication ceremony</a> was initiated,
+       <p>verify that the identified <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user account</a> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record⑨">credential record</a> whose <a data-link-type="dfn" href="#credential-record-id" id="ref-for-credential-record-id②">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①⓪">credential record</a>.
+If <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑥">userHandle</a></code></code> is present,
+verify that it equals the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②①">user handle</a> of the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user account</a>.</p>
+      <dt data-md>If the user was not identified before the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a> was initiated,
       <dd data-md>
-       <p>verify that <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑦">userHandle</a></code></code> is
-present, and that the user identified by this value is the owner of <var>credentialSource</var>.</p>
+       <p>verify that <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑦">userHandle</a></code></code> is present.
+Verify that the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user account</a> identified by <code><var>response</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-userhandle" id="ref-for-dom-authenticatorassertionresponse-userhandle⑧">userHandle</a></code></code> contains a <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①①">credential record</a> whose <a data-link-type="dfn" href="#credential-record-id" id="ref-for-credential-record-id③">id</a> equals <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid④">rawId</a></code></code>.
+Let <var>credentialRecord</var> be that <a data-link-type="dfn" href="#credential-record" id="ref-for-credential-record①②">credential record</a>.</p>
      </dl>
     <li data-md>
-     <p>Using <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id③">id</a></code></code> (or <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid②">rawId</a></code></code>, if <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑧">base64url encoding</a> is inappropriate for your use case), look up the corresponding <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⓪">credential public key</a> and let <var>credentialPublicKey</var> be that <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③①">credential public key</a>.</p>
-    <li data-md>
-     <p>Let <var>cData</var>, <var>authData</var> and <var>sig</var> denote the value of <var>response</var>’s <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson⑧">clientDataJSON</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata②">authenticatorData</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature②">signature</a></code> respectively.</p>
+     <p>Let <var>cData</var>, <var>authData</var> and <var>sig</var> denote the value of <var>response</var>’s <code class="idl"><a data-link-type="idl" href="#dom-authenticatorresponse-clientdatajson" id="ref-for-dom-authenticatorresponse-clientdatajson①⓪">clientDataJSON</a></code>, <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-authenticatordata" id="ref-for-dom-authenticatorassertionresponse-authenticatordata②">authenticatorData</a></code>, and <code class="idl"><a data-link-type="idl" href="#dom-authenticatorassertionresponse-signature" id="ref-for-dom-authenticatorassertionresponse-signature②">signature</a></code> respectively.</p>
     <li data-md>
      <p>Let <var>JSONtext</var> be the result of running <a data-link-type="dfn" href="https://encoding.spec.whatwg.org/#utf-8-decode" id="ref-for-utf-8-decode③">UTF-8 decode</a> on the value of <var>cData</var>.</p>
      <p class="note" role="note"><span>Note:</span> Using any implementation of <a data-link-type="dfn" href="https://encoding.spec.whatwg.org/#utf-8-decode" id="ref-for-utf-8-decode④">UTF-8 decode</a> is acceptable as long as it yields the same result as that yielded by
@@ -4972,54 +5332,58 @@ <h3 class="heading settled" data-level="7.2" id="sctn-verifying-assertion"><span
     <li data-md>
      <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑦">challenge</a></code></code> equals
 the base64url encoding of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge③">challenge</a></code></code>.</p>
-    <li data-md>
-     <p>Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④②">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a>.</p>
+    <li id="rp-op-verifying-assertion-step-origin"><a class="self-link" href="#rp-op-verifying-assertion-step-origin"></a> Verify that the value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑧">origin</a></code></code> matches the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Party</a>'s <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/origin.html#concept-origin" id="ref-for-concept-origin①④">origin</a>. 
     <li id="rp-op-verifying-assertion-step-rpid-hash">
-     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#rpidhash" id="ref-for-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑥">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④③">Relying Party</a>. 
-     <p class="note" role="note"><span>Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1 FIDO AppID Extension (appid)</a> for details.</p>
+     <a class="self-link" href="#rp-op-verifying-assertion-step-rpid-hash"></a> Verify that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash③">rpIdHash</a></code> in <var>authData</var> is the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> expected by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a>. 
+     <p class="note" role="note"><span>Note:</span> If using the <a data-link-type="dfn" href="#appid" id="ref-for-appid①">appid</a> extension, this step needs some special logic. See <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> for details.</p>
     <li data-md>
-     <p>Verify that the <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present⑤">User Present</a> bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags③①">flags</a></code> in <var>authData</var> is set.</p>
+     <p>Verify that the <a data-link-type="dfn" href="#authdata-flags-up" id="ref-for-authdata-flags-up④">UP</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑥">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④④">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a> for this assertion,
-verify that the <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified⑤">User Verified</a> bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags③②">flags</a></code> in <var>authData</var> is set.</p>
+     <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a> requires <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④②">user verification</a> for this assertion,
+verify that the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑧">UV</a> bit of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑦">flags</a></code> in <var>authData</var> is set.</p>
     <li data-md>
-     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑤">backup state</a> is used as part of Relying Party business logic or policy, compare the previously stored
-value with the <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state⑥">backup state</a> (BS) bit of the <code><a data-link-type="dfn" href="#flags" id="ref-for-flags③③">flags</a></code> in <var>authData</var>, perform evaluation, and then store the new value.</p>
+     <p>If the credential <a data-link-type="dfn" href="#backup-state" id="ref-for-backup-state④">backup state</a> is used as part of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> business logic or policy,
+let <var>currentBe</var> and <var>currentBs</var> be the values of the <a data-link-type="dfn" href="#authdata-flags-be" id="ref-for-authdata-flags-be⑧">BE</a> and <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs⑨">BS</a> bits, respectively,
+of the <code><a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑧">flags</a></code> in <var>authData</var>.
+Compare <var>currentBe</var> and <var>currentBs</var> with <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-be" id="ref-for-credential-record-be①">BE</a></code> and <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-bs" id="ref-for-credential-record-bs①">BS</a></code> and apply <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> policy, if any,
+and then update <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-bs" id="ref-for-credential-record-bs②">BS</a></code> to the value of <var>currentBs</var>.</p>
+     <p class="note" role="note"><span>Note:</span> See <a href="#sctn-credential-backup">§ 6.1.3 Credential Backup State</a> for examples of how a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Party</a> might process the <a data-link-type="dfn" href="#authdata-flags-bs" id="ref-for-authdata-flags-bs①⓪">BS</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags③⑨">flag</a> values.</p>
     <li data-md>
      <p>Verify that the values of the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑧">client extension outputs</a> in <var>clientExtensionResults</var> and the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑤">authenticator extension
-outputs</a> in the <code><a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input④">client
-extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑤">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
-In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑥">Relying Party</a> and which extensions are in use.</p>
-     <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑤">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension③">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑦">Relying Parties</a> MUST be prepared to handle such
-situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑧">Relying Party</a> can make this
+outputs</a> in the <code><a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑧">extensions</a></code> in <var>authData</var> are as expected, considering the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client
+extension input</a> values that were given in <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions④">extensions</a></code></code> and any specific policy of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> regarding unsolicited extensions, i.e., those that were not specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑤">extensions</a></code></code>.
+In the general case, the meaning of "are as expected" is specific to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> and which extensions are in use.</p>
+     <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">Client platforms</a> MAY enact local policy that sets additional <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">authenticator extensions</a> or <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension③">client extensions</a> and thus cause values to appear in the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑥">authenticator extension outputs</a> or <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output⑨">client extension outputs</a> that were not originally specified as part of <code><var>options</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-extensions" id="ref-for-dom-publickeycredentialrequestoptions-extensions⑥">extensions</a></code></code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Parties</a> MUST be prepared to handle such
+situations, whether it be to ignore the unsolicited extensions or reject the assertion. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a> can make this
 decision based on local policy and the extensions in use.</p>
-     <p class="note" role="note"><span>Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑦③">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①②">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②④⑨">Relying Party</a> MUST also be
+     <p class="note" role="note"><span>Note:</span> Since all extensions are OPTIONAL for both the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a> and the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Party</a> MUST also be
 prepared to handle cases where none or not all of the requested extensions were acted upon.</p>
     <li data-md>
      <p>Let <var>hash</var> be the result of computing a hash over the <var>cData</var> using SHA-256.</p>
     <li data-md>
-     <p>Using <var>credentialPublicKey</var>, verify that <var>sig</var> is a valid signature over the binary concatenation of <var>authData</var> and <var>hash</var>.</p>
+     <p>Using <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-publickey" id="ref-for-credential-record-publickey①">publicKey</a></code>,
+verify that <var>sig</var> is a valid signature over the binary concatenation of <var>authData</var> and <var>hash</var>.</p>
      <p class="note" role="note"><span>Note:</span> This verification step is compatible with signatures generated by FIDO U2F authenticators. See <a href="#sctn-fido-u2f-sig-format-compat">§ 6.1.2 FIDO U2F Signature Format Compatibility</a>.</p>
     <li data-md>
-     <p>Let <var>storedSignCount</var> be the stored <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⑤">signature counter</a> value associated with <code><var>credential</var>.<code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id" id="ref-for-dom-credential-id④">id</a></code></code>.
-If <var>authData</var>.<code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount⑤">signCount</a></code> is nonzero or <var>storedSignCount</var> is nonzero,
+     <p>If <var>authData</var>.<code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount⑥">signCount</a></code> is nonzero or <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-signcount" id="ref-for-credential-record-signcount①">signCount</a></code> is nonzero,
 then run the following sub-step:</p>
      <ul>
       <li data-md>
-       <p>If <var>authData</var>.<code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount⑥">signCount</a></code> is</p>
+       <p>If <var>authData</var>.<code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount⑦">signCount</a></code> is</p>
        <dl class="switch">
-        <dt>greater than <var>storedSignCount</var>:
-        <dd>Update <var>storedSignCount</var> to be the value of <var>authData</var>.<code><a data-link-type="dfn" href="#signcount" id="ref-for-signcount⑦">signCount</a></code>.
-        <dt>less than or equal to <var>storedSignCount</var>:
+        <dt>greater than <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-signcount" id="ref-for-credential-record-signcount②">signCount</a></code>:
+        <dd>Update <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-signcount" id="ref-for-credential-record-signcount③">signCount</a></code> to be the value of <var>authData</var>.<code><a data-link-type="dfn" href="#authdata-signcount" id="ref-for-authdata-signcount⑧">signCount</a></code>.
+        <dt>less than or equal to <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-signcount" id="ref-for-credential-record-signcount④">signCount</a></code>:
         <dd>This is a signal that
           the authenticator may be cloned, i.e. at least
           two copies of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②①">credential private key</a> may exist and are
-          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⓪">Relying Parties</a> should incorporate this information
-          into their risk scoring.  Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤①">Relying Party</a> updates <var>storedSignCount</var> in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②③">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤②">Relying Party</a>-specific. 
+          being used in parallel. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Parties</a> should incorporate this information
+          into their risk scoring.
+          Whether the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> updates <code><var>credentialRecord</var>.<a data-link-type="dfn" href="#credential-record-signcount" id="ref-for-credential-record-signcount⑤">signCount</a></code> in this case, or not, or fails the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> or not, is <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a>-specific. 
        </dl>
      </ul>
     <li data-md>
-     <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②④">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a>.</p>
+     <p>If all the above steps are successful, continue with the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑤">authentication ceremony</a> as appropriate. Otherwise, fail the <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">authentication ceremony</a>.</p>
    </ol>
    <h2 class="heading settled" data-level="8" id="sctn-defined-attestation-formats"><span class="secno">8. </span><span class="content">Defined Attestation Statement Formats</span><a class="self-link" href="#sctn-defined-attestation-formats"></a></h2>
    <p>WebAuthn supports pluggable attestation statement formats. This section defines an initial set of such formats.</p>
@@ -5038,11 +5402,11 @@ <h3 class="heading settled" data-level="8.1" id="sctn-attstn-fmt-ids"><span clas
    <p>Attestation statement formats that may exist in multiple versions SHOULD include a version in their identifier. In effect,
 different versions are thus treated as different formats, e.g., <code>packed2</code> as a new version of the <a href="#sctn-packed-attestation">§ 8.2 Packed Attestation Statement Format</a>.</p>
    <p>The following sections present a set of currently-defined and registered attestation statement formats and their identifiers.
-The up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑦">WebAuthn Extensions</a> is maintained in the
+The up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> is maintained in the
 IANA "WebAuthn Attestation Statement Format Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>.</p>
    <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span class="secno">8.2. </span><span class="content">Packed Attestation Statement Format</span><a class="self-link" href="#sctn-packed-attestation"></a></h3>
    <p>This is a WebAuthn optimized attestation statement format. It uses a very compact but still extensible encoding method. It is
-implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①③">authenticators</a> with limited resources (e.g., secure elements).</p>
+implementable by <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticators</a> with limited resources (e.g., secure elements).</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -5072,10 +5436,10 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
      <dl>
       <dt data-md>alg
       <dd data-md>
-       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature⑨">attestation signature</a>.</p>
+       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①②">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⓪">attestation signature</a>.</p>
       <dt data-md>sig
       <dd data-md>
-       <p>A byte string containing the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①⓪">attestation signature</a>.</p>
+       <p>A byte string containing the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①①">attestation signature</a>.</p>
       <dt data-md>x5c
       <dd data-md>
        <p>The elements of this array contain <var>attestnCert</var> and its certificate chain (if any), each encoded in X.509 format. The attestation
@@ -5091,7 +5455,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
      <ol>
       <li data-md>
        <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation">authenticator data for the attestation</a>,
-and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">hash of the serialized client data</a>.</p>
+and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑤">hash of the serialized client data</a>.</p>
       <li data-md>
        <p>If <a data-link-type="dfn" href="#basic" id="ref-for-basic②">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca②">AttCA</a> <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑦">attestation</a> is in use, the authenticator produces the <var>sig</var> by concatenating <var>authenticatorData</var> and <var>clientDataHash</var>, and signing the result using an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key③">attestation private key</a> selected through an authenticator-specific
 mechanism. It sets <var>x5c</var> to <var>attestnCert</var> followed by the related certificate chain (if any). It sets <var>alg</var> to the algorithm of the
@@ -5119,7 +5483,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
          <p>Verify that <var>attestnCert</var> meets the requirements in <a href="#sctn-packed-attestation-cert-requirements">§ 8.2.1 Packed Attestation Statement Certificate Requirements</a>.</p>
         <li data-md>
          <p>If <var>attestnCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the
-value of this extension matches the <code><a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑦">aaguid</a></code> in <var>authenticatorData</var>.</p>
+value of this extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑦">aaguid</a></code> in <var>authenticatorData</var>.</p>
         <li data-md>
          <p>Optionally, inspect <var>x5c</var> and consult externally provided knowledge to determine whether <var>attStmt</var> conveys a <a data-link-type="dfn" href="#basic" id="ref-for-basic③">Basic</a> or <a data-link-type="dfn" href="#attca" id="ref-for-attca③">AttCA</a> attestation.</p>
         <li data-md>
@@ -5130,7 +5494,7 @@ <h3 class="heading settled" data-level="8.2" id="sctn-packed-attestation"><span
        <p>If <var>x5c</var> is not present, <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑧">self attestation</a> is in use.</p>
        <ul>
         <li data-md>
-         <p>Validate that <var>alg</var> matches the algorithm of the <code><a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey⑦">credentialPublicKey</a></code> in <var>authenticatorData</var>.</p>
+         <p>Validate that <var>alg</var> matches the algorithm of the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑥">credentialPublicKey</a></code> in <var>authenticatorData</var>.</p>
         <li data-md>
          <p>Verify that <var>sig</var> is a valid signature over the concatenation of <var>authenticatorData</var> and <var>clientDataHash</var> using the
 credential public key with <var>alg</var>.</p>
@@ -5214,7 +5578,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
        <p>The version of the TPM specification to which the signature conforms.</p>
       <dt data-md>alg
       <dd data-md>
-       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①③">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①①">attestation signature</a>.</p>
+       <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-cosealgorithmidentifier" id="ref-for-typedefdef-cosealgorithmidentifier①③">COSEAlgorithmIdentifier</a></code> containing the identifier of the algorithm used to generate the <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①②">attestation signature</a>.</p>
       <dt data-md>x5c
       <dd data-md>
        <p><var>aikCert</var> followed by its certificate chain, in X.509 encoding.</p>
@@ -5223,7 +5587,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
        <p>The AIK certificate used for the attestation, in X.509 encoding.</p>
       <dt data-md>sig
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①②">attestation signature</a>, in the form of a TPMT_SIGNATURE structure as specified in <a data-link-type="biblio" href="#biblio-tpmv2-part2">[TPMv2-Part2]</a> section 11.3.4.</p>
+       <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①③">attestation signature</a>, in the form of a TPMT_SIGNATURE structure as specified in <a data-link-type="biblio" href="#biblio-tpmv2-part2">[TPMv2-Part2]</a> section 11.3.4.</p>
       <dt data-md>certInfo
       <dd data-md>
        <p>The TPMS_ATTEST structure over which the above signature was computed, as specified in <a data-link-type="biblio" href="#biblio-tpmv2-part2">[TPMv2-Part2]</a> section 10.12.8.</p>
@@ -5233,7 +5597,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
-     <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation①">authenticator data for the attestation</a>, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑤">hash of the serialized client data</a>.</p>
+     <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation①">authenticator data for the attestation</a>, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑥">hash of the serialized client data</a>.</p>
      <p>Concatenate <var>authenticatorData</var> and <var>clientDataHash</var> to form <var>attToBeSigned</var>.</p>
      <p>Generate a signature using the procedure specified in <a data-link-type="biblio" href="#biblio-tpmv2-part3">[TPMv2-Part3]</a> Section 18.2, using the attestation private key and
 setting the <code>extraData</code> parameter to the digest of <var>attToBeSigned</var> using the hash algorithm corresponding to the "alg" signature algorithm.
@@ -5246,7 +5610,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
 as follows:</p>
      <p>Verify that <var>attStmt</var> is valid CBOR conforming to the syntax defined above and perform CBOR decoding on it to extract the
 contained fields.</p>
-     <p>Verify that the public key specified by the <code>parameters</code> and <code>unique</code> fields of <var>pubArea</var> is identical to the <code><a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey⑧">credentialPublicKey</a></code> in the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata⑨">attestedCredentialData</a></code> in <var>authenticatorData</var>.</p>
+     <p>Verify that the public key specified by the <code>parameters</code> and <code>unique</code> fields of <var>pubArea</var> is identical to the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑦">credentialPublicKey</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑧">attestedCredentialData</a></code> in <var>authenticatorData</var>.</p>
      <p>Concatenate <var>authenticatorData</var> and <var>clientDataHash</var> to form <var>attToBeSigned</var>.</p>
      <p>Validate that <var>certInfo</var> is valid:</p>
      <ul>
@@ -5272,7 +5636,7 @@ <h3 class="heading settled" data-level="8.3" id="sctn-tpm-attestation"><span cla
        <p>Verify that <var>aikCert</var> meets the requirements in <a href="#sctn-tpm-cert-requirements">§ 8.3.1 TPM Attestation Statement Certificate Requirements</a>.</p>
       <li data-md>
        <p>If <var>aikCert</var> contains an extension with OID <code>1.3.6.1.4.1.45724.1.1.4</code> (<code>id-fido-gen-ce-aaguid</code>) verify that the value of this
-extension matches the <code><a data-link-type="dfn" href="#aaguid" id="ref-for-aaguid⑧">aaguid</a></code> in <var>authenticatorData</var>.</p>
+extension matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-aaguid" id="ref-for-authdata-attestedcredentialdata-aaguid⑧">aaguid</a></code> in <var>authenticatorData</var>.</p>
       <li data-md>
        <p>If successful, return implementation-specific values representing <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type①⑨">attestation type</a> <a data-link-type="dfn" href="#attca" id="ref-for-attca⑥">AttCA</a> and <a data-link-type="dfn" href="#attestation-trust-path" id="ref-for-attestation-trust-path⑤">attestation trust
 path</a> <var>x5c</var>.</p>
@@ -5297,11 +5661,11 @@ <h4 class="heading settled" data-level="8.3.1" id="sctn-tpm-cert-requirements"><
 See, for example, the FIDO Metadata Service <a data-link-type="biblio" href="#biblio-fidometadataservice">[FIDOMetadataService]</a>.</p>
    </ul>
    <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><span class="secno">8.4. </span><span class="content">Android Key Attestation Statement Format</span><a class="self-link" href="#sctn-android-key-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①④">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticator</a> in question is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑤">platform authenticator</a> on the Android "N" or later platform, the
 attestation statement is based on the <a href="https://source.android.com/security/keystore/attestation">Android key
 attestation</a>. In these cases, the attestation statement
 is produced by a component running in a secure operating environment, but the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation②">authenticator data for the attestation</a> is
-produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑧">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
+produced outside this environment. The <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a> is expected to check that the <a data-link-type="dfn" href="#authenticator-data-claimed-to-have-been-used-for-the-attestation" id="ref-for-authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for
 the attestation</a> is consistent with the fields of the attestation certificate’s extension data.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
@@ -5329,7 +5693,7 @@ <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><
 </pre>
     <dt data-md>Signing procedure
     <dd data-md>
-     <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation③">authenticator data for the attestation</a>, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑥">hash of the serialized client data</a>.</p>
+     <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation③">authenticator data for the attestation</a>, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑦">hash of the serialized client data</a>.</p>
      <p>Request an Android Key Attestation by calling <code>keyStore.getCertificateChain(myKeyUUID)</code> providing <var>clientDataHash</var> as the
 challenge value (e.g., by using <a href="https://developer.android.com/reference/android/security/keystore/KeyGenParameterSpec.Builder.html#setAttestationChallenge(byte%5B%5D)"> setAttestationChallenge</a>). Set <var>x5c</var> to the returned value.</p>
      <p>The authenticator produces <var>sig</var> by concatenating <var>authenticatorData</var> and <var>clientDataHash</var>,
@@ -5346,7 +5710,7 @@ <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><
        <p>Verify that <var>sig</var> is a valid signature over the concatenation of <var>authenticatorData</var> and <var>clientDataHash</var> using the
 public key in the first certificate in <var>x5c</var> with the algorithm specified in <var>alg</var>.</p>
       <li data-md>
-       <p>Verify that the public key in the first certificate in <var>x5c</var> matches the <code><a data-link-type="dfn" href="#credentialpublickey" id="ref-for-credentialpublickey⑨">credentialPublicKey</a></code> in the <code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata①⓪">attestedCredentialData</a></code> in <var>authenticatorData</var>.</p>
+       <p>Verify that the public key in the first certificate in <var>x5c</var> matches the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata-credentialpublickey" id="ref-for-authdata-attestedcredentialdata-credentialpublickey⑧">credentialPublicKey</a></code> in the <code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata⑨">attestedCredentialData</a></code> in <var>authenticatorData</var>.</p>
       <li data-md>
        <p>Verify that the <code>attestationChallenge</code> field in the <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑦">attestation certificate</a> <a data-link-type="dfn" href="#android-key-attestation-certificate-extension-data" id="ref-for-android-key-attestation-certificate-extension-data">extension data</a> is identical to <var>clientDataHash</var>.</p>
       <li data-md>
@@ -5354,7 +5718,7 @@ <h3 class="heading settled" data-level="8.4" id="sctn-android-key-attestation"><
        <ul>
         <li data-md>
          <p>The <code>AuthorizationList.allApplications</code> field is <em>not</em> present on either authorization list
-(<code>softwareEnforced</code> nor <code>teeEnforced</code>), since PublicKeyCredential MUST be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑥">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑦">RP ID</a>.</p>
+(<code>softwareEnforced</code> nor <code>teeEnforced</code>), since PublicKeyCredential MUST be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑥">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑨">RP ID</a>.</p>
         <li data-md>
          <p>For the following, use only the <code>teeEnforced</code> authorization list if the RP wants to accept only keys from a
 trusted execution environment, otherwise use the union of <code>teeEnforced</code> and <code>softwareEnforced</code>.</p>
@@ -5374,9 +5738,9 @@ <h4 class="heading settled" data-level="8.4.1" id="sctn-key-attstn-cert-requirem
    <p>Android Key Attestation <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑧">attestation certificate</a>'s <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="android key attestation certificate extension data" data-noexport id="android-key-attestation-certificate-extension-data">android key attestation certificate extension
 data</dfn> is identified by the OID <code>1.3.6.1.4.1.11129.2.1.17</code>, and its schema is defined in the <a href="https://developer.android.com/training/articles/security-key-attestation#certificate_schema">Android developer documentation</a>.</p>
    <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestation"><span class="secno">8.5. </span><span class="content">Android SafetyNet Attestation Statement Format</span><a class="self-link" href="#sctn-android-safetynet-attestation"></a></h3>
-   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
+   <p>When the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators②⑥">platform authenticator</a> on certain Android platforms, the attestation
 statement may be based on the <a href="https://developer.android.com/training/safetynet/attestation#compat-check-response">SafetyNet API</a>. In
-this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④④">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
+this case the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑥">authenticator data</a> is completely controlled by the caller of the SafetyNet API (typically an application
 running on the Android platform) and the attestation statement  provides some statements about the health of the platform
 and the identity of the calling application
 (see <a href="https://developer.android.com/training/safetynet/attestation.html">SafetyNet Documentation</a> for more details).</p>
@@ -5412,7 +5776,7 @@ <h3 class="heading settled" data-level="8.5" id="sctn-android-safetynet-attestat
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
-     <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation④">authenticator data for the attestation</a>, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑦">hash of the serialized client data</a>.</p>
+     <p>Let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation④">authenticator data for the attestation</a>, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑧">hash of the serialized client data</a>.</p>
      <p>Concatenate <var>authenticatorData</var> and <var>clientDataHash</var>, perform SHA-256 hash of the concatenated string, and
 let the result of the hash form <var>attToBeSigned</var>.</p>
      <p>Request a SafetyNet attestation, providing <var>attToBeSigned</var> as the nonce value. Set <var>response</var> to the result, and <var>ver</var> to
@@ -5466,18 +5830,18 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
        <p>A single element array containing the attestation certificate in X.509 format.</p>
       <dt data-md>sig
       <dd data-md>
-       <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①③">attestation signature</a>.
-The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦④">client</a> from the authenticator.</p>
+       <p>The <a data-link-type="dfn" href="#attestation-signature" id="ref-for-attestation-signature①④">attestation signature</a>.
+The signature was calculated over the (raw) U2F registration response message <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a> received by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> from the authenticator.</p>
      </dl>
     <dt data-md>Signing procedure
     <dd data-md>
-     <p>If the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③②">credential public key</a> of the <a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata①①">attested credential</a> is not of algorithm -7 ("ES256"), stop and return an error.
+     <p>If the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③②">credential public key</a> of the <a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①⓪">attested credential</a> is not of algorithm -7 ("ES256"), stop and return an error.
 Otherwise, let <var>authenticatorData</var> denote the <a data-link-type="dfn" href="#authenticator-data-for-the-attestation" id="ref-for-authenticator-data-for-the-attestation⑤">authenticator data for the attestation</a>,
-and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑧">hash of the serialized client data</a>. (Since SHA-256 is used to hash the
+and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑨">hash of the serialized client data</a>. (Since SHA-256 is used to hash the
 serialized <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①①">client data</a>, <var>clientDataHash</var> will be 32 bytes long.)</p>
      <p>Generate a Registration Response Message as specified in <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a> <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html#registration-response-message-success" id="ref-for-registration-response-message-success">Section 4.3</a>, with the application parameter set to the
-SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑧">RP ID</a> that the given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤④">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑦">scoped</a> to, the challenge parameter set to <var>clientDataHash</var>, and the key handle
-parameter set to the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③③">credential ID</a> of the given credential. Set the raw signature part of this Registration Response Message (i.e., without the <a data-link-type="dfn" href="#user-public-key" id="ref-for-user-public-key①">user public key</a>,
+SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⓪">RP ID</a> that the given <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑤">credential</a> is <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑦">scoped</a> to, the challenge parameter set to <var>clientDataHash</var>, and the key handle
+parameter set to the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑥">credential ID</a> of the given credential. Set the raw signature part of this Registration Response Message (i.e., without the <a data-link-type="dfn" href="#user-public-key" id="ref-for-user-public-key①">user public key</a>,
 key handle, and attestation certificates) as <var>sig</var> and set the attestation certificates of
 the attestation public key as <var>x5c</var>.</p>
     <dt data-md>Verification procedure
@@ -5493,7 +5857,7 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
 conveyed by <var>attCert</var>. If <var>certificate public key</var> is not an Elliptic Curve (EC) public
 key over the P-256 curve, terminate this algorithm and return an appropriate error.</p>
       <li data-md>
-       <p>Extract the claimed <var>rpIdHash</var> from <var>authenticatorData</var>, and the claimed <var>credentialId</var> and <var>credentialPublicKey</var> from <var>authenticatorData</var>.<code><a data-link-type="dfn" href="#attestedcredentialdata" id="ref-for-attestedcredentialdata①②">attestedCredentialData</a></code>.</p>
+       <p>Extract the claimed <var>rpIdHash</var> from <var>authenticatorData</var>, and the claimed <var>credentialId</var> and <var>credentialPublicKey</var> from <var>authenticatorData</var>.<code><a data-link-type="dfn" href="#authdata-attestedcredentialdata" id="ref-for-authdata-attestedcredentialdata①①">attestedCredentialData</a></code>.</p>
       <li data-md>
        <p>Convert the COSE_KEY formatted <var>credentialPublicKey</var> (see <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8152#section-7" id="ref-for-section-7④">Section 7</a> of <a data-link-type="biblio" href="#biblio-rfc8152">[RFC8152]</a>) to Raw ANSI X9.62 public key
 format (see ALG_KEY_ECC_X962_RAW in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#public-key-representation-formats" id="ref-for-public-key-representation-formats">Section 3.6.2 Public Key Representation Formats</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>).</p>
@@ -5522,9 +5886,9 @@ <h3 class="heading settled" data-level="8.6" id="sctn-fido-u2f-attestation"><spa
      </ol>
    </dl>
    <h3 class="heading settled" data-level="8.7" id="sctn-none-attestation"><span class="secno">8.7. </span><span class="content">None Attestation Statement Format</span><a class="self-link" href="#sctn-none-attestation"></a></h3>
-   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑥">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑥">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party②⑨">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
-   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑦">authenticator</a> MAY also directly generate attestation statements of this format
-if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑧">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>.</p>
+   <p>The none attestation statement format is used to replace any <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticator</a>-provided <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">attestation statement</a> when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information, see <a href="#enum-attestation-convey">§ 5.4.7 Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>.</p>
+   <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticator</a> MAY also directly generate attestation statements of this format
+if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a> does not support <a data-link-type="dfn" href="#attestation" id="ref-for-attestation①⑧">attestation</a>.</p>
    <dl>
     <dt data-md>Attestation statement format identifier
     <dd data-md>
@@ -5583,7 +5947,7 @@ <h3 class="heading settled" data-level="8.8" id="sctn-apple-anonymous-attestatio
     <dd data-md>
      <ol>
       <li data-md>
-       <p>Let <var>authenticatorData</var> denote the authenticator data for the attestation, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑨">hash of the serialized client data</a>.</p>
+       <p>Let <var>authenticatorData</var> denote the authenticator data for the attestation, and let <var>clientDataHash</var> denote the <a data-link-type="dfn" href="#collectedclientdata-hash-of-the-serialized-client-data" id="ref-for-collectedclientdata-hash-of-the-serialized-client-data②⓪">hash of the serialized client data</a>.</p>
       <li data-md>
        <p>Concatenate <var>authenticatorData</var> and <var>clientDataHash</var> to form <var>nonceToHash</var>.</p>
       <li data-md>
@@ -5612,25 +5976,25 @@ <h3 class="heading settled" data-level="8.8" id="sctn-apple-anonymous-attestatio
      </ol>
    </dl>
    <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="secno">9. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="webauthn-extensions">WebAuthn Extensions</dfn></span><a class="self-link" href="#sctn-extensions"></a></h2>
-   <p>The mechanism for generating <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑤">public key credentials</a>, as well as requesting and generating Authentication assertions, as
+   <p>The mechanism for generating <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credentials</a>, as well as requesting and generating Authentication assertions, as
 defined in <a href="#sctn-api">§ 5 Web Authentication API</a>, can be extended to suit particular use cases. Each case is addressed by defining a <dfn class="dfn-paneled" data-dfn-type="dfn" data-lt="registration extension" data-noexport id="registration-extension">registration
 extension</dfn> and/or an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authentication-extension">authentication extension</dfn>.</p>
    <p>Every extension is a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension">client extension</dfn>, meaning that the extension involves communication with and processing by the
 client. <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension④">Client extensions</a> define the following steps and data:</p>
    <ul>
     <li data-md>
-     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑤">navigator.credentials.create()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②">registration extensions</a>.</p>
+     <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">navigator.credentials.create()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②">registration extensions</a>.</p>
     <li data-md>
      <p><code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⓪">navigator.credentials.get()</a></code> extension request parameters and response values for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②">authentication extensions</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑤">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
+     <p><a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">Client extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension③">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension③">authentication extensions</a>.</p>
    </ul>
-   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑥">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⓪">WebAuthn Relying Party</a> can request the use of a set
-of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤③">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑤">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code> call
-(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑥">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑤">client</a>.
-The <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑥">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑥">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑥">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑧">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
+   <p>When creating a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key credential</a> or requesting an <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①③">authentication assertion</a>, a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> can request the use of a set
+of extensions. These extensions will be invoked during the requested operation if they are supported by the client and/or the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑥">WebAuthn Authenticator</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> sends the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> for each extension in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③①">get()</a></code> call
+(for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension④">authentication extensions</a>) or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension④">registration extensions</a>) to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a>.
+The <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> performs <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a> for each extension that the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">client platform</a> supports, and augments the <a data-link-type="dfn" href="#client-data" id="ref-for-client-data①③">client data</a> as specified by each extension, by including the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> and <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⓪">client extension output</a> values.</p>
    <p>An extension can also be an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension">authenticator extension</dfn>, meaning that the extension involves communication with and
-processing by the authenticator. <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension④">Authenticator extensions</a> define the following steps and data:</p>
+processing by the authenticator. <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑤">Authenticator extensions</a> define the following steps and data:</p>
    <ul>
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑥">authenticatorMakeCredential</a> extension request parameters and response values for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑤">registration extensions</a>.</p>
@@ -5639,23 +6003,23 @@ <h2 class="heading settled" data-level="9" id="sctn-extensions"><span class="sec
     <li data-md>
      <p><a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing②">Authenticator extension processing</a> for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑥">registration extensions</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑥">authentication extensions</a>.</p>
    </ul>
-   <p>For <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑤">authenticator extensions</a>, as part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑦">client extension processing</a>, the client also creates the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①①">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑤">authenticator extension input</a> value for each extension (often based on the corresponding <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑥">client extension input</a> value),
-and passes them to the authenticator in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑦">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑦">registration extensions</a>) or the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">get()</a></code> call (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑦">authentication extensions</a>). These <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑥">authenticator extension input</a> values are
-represented in <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①②">CBOR</a> and passed as name-value pairs, with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier⑨">extension identifier</a> as the name, and the corresponding <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑦">authenticator extension input</a> as the value. The authenticator, in turn, performs additional processing for the extensions
+   <p>For <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑥">authenticator extensions</a>, as part of the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑧">client extension processing</a>, the client also creates the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①①">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑤">authenticator extension input</a> value for each extension (often based on the corresponding <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑧">client extension input</a> value),
+and passes them to the authenticator in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> call (for <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑦">registration extensions</a>) or the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③②">get()</a></code> call (for <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑦">authentication extensions</a>). These <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑥">authenticator extension input</a> values are
+represented in <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①②">CBOR</a> and passed as name-value pairs, with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a> as the name, and the corresponding <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑦">authenticator extension input</a> as the value. The authenticator, in turn, performs additional processing for the extensions
 that it supports, and returns the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①③">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑦">authenticator extension output</a> for each as specified by the extension. Part of
-the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑧">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑥">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> as an
+the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extensions</a> is to use the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑧">authenticator extension output</a> as an
 input to creating the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①①">client extension output</a>.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑧">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤④">Relying Party</a> MAY be
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> are OPTIONAL for both clients and authenticators. Thus, any extensions requested by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> MAY be
 ignored by the client browser or OS and not passed to the authenticator at all, or they MAY be ignored by the authenticator.
-Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑤">Relying Parties</a> include extensions with any
+Ignoring an extension is never considered a failure in WebAuthn API processing, so when <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Parties</a> include extensions with any
 API calls, they MUST be prepared to handle cases where some or all of those extensions are ignored.</p>
-   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions⑨">WebAuthn Extensions</a> MUST be defined in such a way that this implementation choice does not endanger the user’s
+   <p>All <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a> MUST be defined in such a way that this implementation choice does not endanger the user’s
 security or privacy. For instance, if an extension requires client processing, it could be defined in a manner that ensures such
 a naïve pass-through will produce a semantically invalid <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑧">authenticator extension input</a> value, resulting in the extension
 being ignored by the authenticator. Since all extensions are OPTIONAL, this will not cause a functional failure in the API
 operation.</p>
    <p>The IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a> can be consulted
-for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①⓪">WebAuthn Extensions</a>.</p>
+for an up-to-date list of registered <a data-link-type="dfn" href="#webauthn-extensions" id="ref-for-webauthn-extensions①①">WebAuthn Extensions</a>.</p>
    <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class="secno">9.1. </span><span class="content">Extension Identifiers</span><a class="self-link" href="#sctn-extension-id"></a></h3>
    <p>Extensions are identified by a string, called an <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="extension-identifier">extension identifier</dfn>, chosen by the extension author.</p>
    <p>Extension identifiers SHOULD be registered in the
@@ -5670,27 +6034,27 @@ <h3 class="heading settled" data-level="9.1" id="sctn-extension-id"><span class=
    <p><a href="#sctn-defined-extensions">§ 10 Defined Extensions</a> defines an additional set of extensions and their identifiers.
 See the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a> for an up-to-date list of registered WebAuthn Extension Identifiers.</p>
    <h3 class="heading settled" data-level="9.2" id="sctn-extension-specification"><span class="secno">9.2. </span><span class="content">Defining Extensions</span><a class="self-link" href="#sctn-extension-specification"></a></h3>
-   <p>A definition of an extension MUST specify an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⓪">extension identifier</a>, a <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑦">client extension input</a> argument
-to be sent via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑧">create()</a></code> call,
-the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing⑨">client extension processing</a> rules, and a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①②">client extension output</a> value.
-If the extension communicates with the authenticator (meaning it is an <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑦">authenticator extension</a>),
+   <p>A definition of an extension MUST specify an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①①">extension identifier</a>, a <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension input</a> argument
+to be sent via the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③③">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> call,
+the <a data-link-type="dfn" href="#client-extension-processing" id="ref-for-client-extension-processing①⓪">client extension processing</a> rules, and a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①②">client extension output</a> value.
+If the extension communicates with the authenticator (meaning it is an <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑧">authenticator extension</a>),
 it MUST also specify the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①④">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input⑨">authenticator extension input</a> argument
 sent via the <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑦">authenticatorGetAssertion</a> or <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑦">authenticatorMakeCredential</a> call,
 the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing③">authenticator extension processing</a> rules, and the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑤">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output⑨">authenticator extension output</a> value.</p>
-   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③①">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
-an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑥">Relying Party</a> know that the extension was honored by the authenticator. If an
+   <p>Any <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑤">client extension</a> that is processed by the client MUST return a <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①③">client extension output</a> value so that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Party</a> knows that the extension was honored by the client. Similarly, any extension that requires authenticator processing MUST return
+an <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⓪">authenticator extension output</a> to let the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a> know that the extension was honored by the authenticator. If an
 extension does not otherwise require any result values, it SHOULD be defined as returning a JSON Boolean <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①④">client extension
-output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑧">authenticator
+output</a> result, set to <code>true</code> to signify that the extension was understood and processed. Likewise, any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator
 extension</a> that does not otherwise require any result values MUST return a value and SHOULD return a CBOR Boolean <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①①">authenticator extension output</a> result, set to <code>true</code> to signify that the extension was understood and processed.</p>
    <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-parameters"><span class="secno">9.3. </span><span class="content">Extending Request Parameters</span><a class="self-link" href="#sctn-extension-request-parameters"></a></h3>
    <p>An extension defines one or two request arguments. The <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-input">client extension input</dfn>,
-which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③②">WebAuthn Relying Party</a> to the client
-in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create②⑨">create()</a></code> call,
+which is a value that can be encoded in JSON, is passed from the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Party</a> to the client
+in the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③④">get()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">create()</a></code> call,
 while the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑥">CBOR</a> <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-input">authenticator extension input</dfn> is
-passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension⑨">authenticator extensions</a> during the processing of these calls.</p>
-   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑦">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑧">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③⓪">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> call.
-The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①①">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input⑨">client extension input</a>.</p>
-   <p class="note" role="note"><span>Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a> as the entry key.
+passed from the client to the authenticator for <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extensions</a> during the processing of these calls.</p>
+   <p>A <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a> simultaneously requests the use of an extension and sets its <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⓪">client extension input</a> by including an entry in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-extensions" id="ref-for-dom-publickeycredentialcreationoptions-extensions⑦">extensions</a></code> option to the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">create()</a></code> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑤">get()</a></code> call.
+The entry key is the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①②">extension identifier</a> and the value is the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a>.</p>
+   <p class="note" role="note"><span>Note:</span> Other documents have specified extensions where the extension input does not always use the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> as the entry key.
 New extensions SHOULD follow the above convention.</p>
 <pre class="example highlight" id="example-5335c503"><a class="self-link" href="#example-5335c503"></a><c- a>var</c-> assertionPromise <c- o>=</c-> navigator<c- p>.</c->credentials<c- p>.</c->get<c- p>({</c->
     publicKey<c- o>:</c-> <c- p>{</c->
@@ -5706,17 +6070,17 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
     <c- p>}</c->
 <c- p>});</c->
 </pre>
-   <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⓪">client extension input</a>. Clients SHOULD ignore extensions with
-an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①①">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑧">Relying Party</a>, it SHOULD be defined
-as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑤⑨">Relying Party</a>.</p>
+   <p>Extension definitions MUST specify the valid values for their <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension input</a>. Clients SHOULD ignore extensions with
+an invalid <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a>. If an extension does not require any parameters from the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Party</a>, it SHOULD be defined
+as taking a Boolean client argument, set to <code>true</code> to signify that the extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a>.</p>
    <p>Extensions that only affect client processing need not specify <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⓪">authenticator extension input</a>. Extensions that have
-authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①②">client extension
+authenticator processing MUST specify the method of computing the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①①">authenticator extension input</a> from the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension
 input</a>,
-and MUST define extensions for the <a data-link-type="dfn" href="#cddl" id="ref-for-cddl②">CDDL</a> types <code><a href="#iface-authentication-extensions-authenticator-inputs">AuthenticationExtensionsAuthenticatorInputs</a></code> and <code><a href="#iface-authentication-extensions-authenticator-outputs">AuthenticationExtensionsAuthenticatorOutputs</a></code> by defining an additional choice for the <code>$$extensionInput</code> and <code>$$extensionOutput</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9">group sockets</a> using the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①③">extension identifier</a> as the entry key.
-Extensions that do not require input parameters, and are thus defined as taking a Boolean <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①③">client extension input</a> value set to <code>true</code>,
+and MUST define extensions for the <a data-link-type="dfn" href="#cddl" id="ref-for-cddl②">CDDL</a> types <code><a href="#iface-authentication-extensions-authenticator-inputs">AuthenticationExtensionsAuthenticatorInputs</a></code> and <code><a href="#iface-authentication-extensions-authenticator-outputs">AuthenticationExtensionsAuthenticatorOutputs</a></code> by defining an additional choice for the <code>$$extensionInput</code> and <code>$$extensionOutput</code> <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc8610#section-3.9" id="ref-for-section-3.9">group sockets</a> using the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①④">extension identifier</a> as the entry key.
+Extensions that do not require input parameters, and are thus defined as taking a Boolean <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension input</a> value set to <code>true</code>,
 SHOULD define the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①②">authenticator extension input</a> also as the constant Boolean value <code>true</code> (CBOR major type
 7, value 21).</p>
-   <p>The following example defines that an extension with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①④">identifier</a> <code>webauthnExample_foobar</code> takes an unsigned integer as <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①③">authenticator extension input</a>,
+   <p>The following example defines that an extension with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑤">identifier</a> <code>webauthnExample_foobar</code> takes an unsigned integer as <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①③">authenticator extension input</a>,
 and returns an array of at least one byte string as <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①②">authenticator extension output</a>:</p>
 <pre class="example" id="example-c42718c0"><a class="self-link" href="#example-c42718c0"></a>$$extensionInput //= (
   webauthnExample_foobar: uint
@@ -5728,58 +6092,60 @@ <h3 class="heading settled" data-level="9.3" id="sctn-extension-request-paramete
    <p class="note" role="note"><span>Note:</span> Extensions should aim to define authenticator arguments that are as small as possible. Some authenticators communicate
     over low-bandwidth links such as Bluetooth Low-Energy or NFC.</p>
    <h3 class="heading settled" data-level="9.4" id="sctn-client-extension-processing"><span class="secno">9.4. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-processing">Client Extension Processing</dfn></span><a class="self-link" href="#sctn-client-extension-processing"></a></h3>
-   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑦">client</a> during the creation of credentials or the
-generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①④">client extension input</a> for the extension is used as an input to this client processing.
-For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map⑨">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑤">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑤">client extension input</a> as the value.</p>
-   <p>Likewise, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑤">client extension outputs</a> are represented as a dictionary in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults③">getClientExtensionResults()</a></code> with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑥">extension identifiers</a> as keys, and the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-output">client extension output</dfn> value of each extension as the value.
-Like the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑥">client extension input</a>, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑥">client extension output</a> is a value that can be encoded in JSON.
+   <p>Extensions MAY define additional processing requirements on the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> during the creation of credentials or the
+generation of an assertion. The <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑥">client extension input</a> for the extension is used as an input to this client processing.
+For each supported <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑥">client extension</a>, the client adds an entry to the <var>clientExtensions</var> <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#ordered-map" id="ref-for-ordered-map①②">map</a> with the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑥">extension identifier</a> as the key, and the extension’s <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a> as the value.</p>
+   <p>Likewise, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑤">client extension outputs</a> are represented as a dictionary in the result of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-getclientextensionresults" id="ref-for-dom-publickeycredential-getclientextensionresults④">getClientExtensionResults()</a></code> with <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifiers</a> as keys, and the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="client-extension-output">client extension output</dfn> value of each extension as the value.
+Like the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑧">client extension input</a>, the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑥">client extension output</a> is a value that can be encoded in JSON.
 There MUST NOT be any values returned for ignored extensions.</p>
    <p>Extensions that require authenticator processing MUST define
-the process by which the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑦">client extension input</a> can be used to determine the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑦">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①④">authenticator extension input</a> and
+the process by which the <a data-link-type="dfn" href="#client-extension-input" id="ref-for-client-extension-input①⑨">client extension input</a> can be used to determine the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑦">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①④">authenticator extension input</a> and
 the process by which the <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑧">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①③">authenticator extension output</a> can be used to determine the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑦">client extension output</a>.</p>
    <h3 class="heading settled" data-level="9.5" id="sctn-authenticator-extension-processing"><span class="secno">9.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-processing">Authenticator Extension Processing</dfn></span><a class="self-link" href="#sctn-authenticator-extension-processing"></a></h3>
-   <p>The <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑨">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑤">authenticator extension input</a> value of each processed <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⓪">authenticator extension</a> is included in the <var>extensions</var> parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑧">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑧">authenticatorGetAssertion</a> operations. The <var>extensions</var> parameter is a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor②⓪">CBOR</a> map where each key is an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑦">extension identifier</a> and the corresponding value is the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑥">authenticator extension input</a> for that extension.</p>
-   <p>Likewise, the extension output is represented in the <a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions⑨">extensions</a> part of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑤">authenticator data</a>. The <a data-link-type="dfn" href="#authdataextensions" id="ref-for-authdataextensions①⓪">extensions</a> part of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑥">authenticator data</a> is a CBOR map where each key is an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑧">extension identifier</a> and the corresponding value is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-output">authenticator extension output</dfn> for that extension.</p>
+   <p>The <a data-link-type="dfn" href="#cbor" id="ref-for-cbor①⑨">CBOR</a> <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑤">authenticator extension input</a> value of each processed <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①①">authenticator extension</a> is included in the <var>extensions</var> parameter of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑧">authenticatorMakeCredential</a> and <a data-link-type="dfn" href="#authenticatorgetassertion" id="ref-for-authenticatorgetassertion①⑧">authenticatorGetAssertion</a> operations. The <var>extensions</var> parameter is a <a data-link-type="dfn" href="#cbor" id="ref-for-cbor②⓪">CBOR</a> map where each key is an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑧">extension identifier</a> and the corresponding value is the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑥">authenticator extension input</a> for that extension.</p>
+   <p>Likewise, the extension output is represented in the <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions⑨">extensions</a> part of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑦">authenticator data</a>. The <a data-link-type="dfn" href="#authdata-extensions" id="ref-for-authdata-extensions①⓪">extensions</a> part of the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑧">authenticator data</a> is a CBOR map where each key is an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑨">extension identifier</a> and the corresponding value is the <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-output">authenticator extension output</dfn> for that extension.</p>
    <p>For each supported extension, the <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing④">authenticator extension processing</a> rule for that extension is used create the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①④">authenticator extension output</a> from the <a data-link-type="dfn" href="#authenticator-extension-input" id="ref-for-authenticator-extension-input①⑦">authenticator extension input</a> and possibly also other inputs.
 There MUST NOT be any values returned for ignored extensions.</p>
    <h2 class="heading settled" data-level="10" id="sctn-defined-extensions"><span class="secno">10. </span><span class="content">Defined Extensions</span><a class="self-link" href="#sctn-defined-extensions"></a></h2>
-   <p>This section defines an additional set of extensions to be registered in the
+   <p>This section and its subsections define an additional set of extensions to be registered in the
 IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>.
 These MAY be implemented by user agents targeting broad interoperability.</p>
-   <h3 class="heading settled" data-level="10.1" id="sctn-appid-extension"><span class="secno">10.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h3>
-   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③③">WebAuthn Relying Parties</a> that have previously registered a
+   <h3 class="heading settled" data-level="10.1" id="sctn-defined-client-extensions"><span class="secno">10.1. </span><span class="content">Client Extensions</span><a class="self-link" href="#sctn-defined-client-extensions"></a></h3>
+   <p>This section defines extensions that are only <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑦">client extensions</a>.</p>
+   <h4 class="heading settled" data-level="10.1.1" id="sctn-appid-extension"><span class="secno">10.1.1. </span><span class="content">FIDO <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="appid">AppID</dfn> Extension (appid)</span><a class="self-link" href="#sctn-appid-extension"></a></h4>
+   <p>This extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Parties</a> that have previously registered a
 credential using the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi">[FIDOU2FJavaScriptAPI]</a> to request an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion③">assertion</a>. The
-FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⓪">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
+FIDO APIs use an alternative identifier for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Parties</a> called an <var>AppID</var> <a data-link-type="biblio" href="#biblio-fido-appid">[FIDO-APPID]</a>, and any credentials created using those APIs will be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑧">scoped</a> to
 that identifier. Without this extension, they would need to be re-registered in
-order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id③⑨">RP ID</a>.</p>
+order to be <a data-link-type="dfn" href="#scope" id="ref-for-scope①⑨">scoped</a> to an <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
    <p>In addition to setting the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid">appid</a></code> extension input,
-using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥①">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
+using this extension requires some additional processing by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> in order to allow users to <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①③">authenticate</a> using their registered U2F credentials:</p>
    <ol>
     <li data-md>
      <p>List the desired U2F credentials in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">allowCredentials</a></code> option
  of the <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑥">get()</a></code> method:</p>
      <ul>
       <li data-md>
-       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type④">type</a></code> members to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑤">public-key</a></code>.</p>
+       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-type" id="ref-for-dom-publickeycredentialdescriptor-type⑤">type</a></code> members to <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑤">public-key</a></code>.</p>
       <li data-md>
-       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑥">id</a></code> members to the respective U2F key handles of the desired credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding⑨">base64url encoding</a> but must be decoded to their binary form when used in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑦">id</a></code>.</p>
+       <p>Set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code> members to the respective U2F key handles of the desired credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①③">base64url encoding</a> but must be decoded to their binary form when used in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①⓪">id</a></code>.</p>
      </ul>
      <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">allowCredentials</a></code> MAY contain a mixture
- of both WebAuthn <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③④">credential IDs</a> and U2F key handles;
+ of both WebAuthn <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑦">credential IDs</a> and U2F key handles;
  stating the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid①">appid</a></code> via this extension
  does not prevent the user from using a WebAuthn-registered credential
- scoped to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⓪">RP ID</a> stated in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑤">rpId</a></code>.</p>
+ scoped to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④②">RP ID</a> stated in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-rpid" id="ref-for-dom-publickeycredentialrequestoptions-rpid⑤">rpId</a></code>.</p>
     <li data-md>
-     <p>When <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, expect that the <code><a data-link-type="dfn" href="#rpidhash" id="ref-for-rpidhash④">rpIdHash</a></code> MAY be the hash of the <var>AppID</var> instead of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④①">RP ID</a>.</p>
+     <p>When <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, expect that the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash④">rpIdHash</a></code> MAY be the hash of the <var>AppID</var> instead of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④③">RP ID</a>.</p>
    </ol>
    <p>This extension does not allow FIDO-compatible credentials to be created. Thus,
 credentials created with WebAuthn are not backwards compatible with the FIDO
 JavaScript APIs.</p>
    <p class="note" role="note"><span>Note:</span> <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientinputs-appid" id="ref-for-dom-authenticationextensionsclientinputs-appid②">appid</a></code> should be set to the AppID
-that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥②">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
-This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥③">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④②">RP ID</a> to the AppID format,
+that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Party</a> <em>previously</em> used in the legacy FIDO APIs.
+This might not be the same as the result of translating the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Party</a>'s WebAuthn <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a> to the AppID format,
 e.g., the previously used AppID may have been "https://accounts.example.com"
-but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④③">RP ID</a> might be "example.com".</p>
+but the currently used <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a> might be "example.com".</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -5804,7 +6170,7 @@ <h3 class="heading settled" data-level="10.1" id="sctn-appid-extension"><span cl
        <p>Let <var>appId</var> be the extension input.</p>
       <li data-md>
        <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid①">determining if a
-caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑦">DOMException</a></code>.</p>
+caller’s FacetID is authorized for an AppID</a>. If that algorithm rejects <var>appId</var> then return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror④">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code>.</p>
       <li data-md>
        <p>When <a href="#allowCredentialDescriptorListCreation">building allowCredentialDescriptorList</a>,
 if a U2F authenticator indicates that a credential is inapplicable (i.e. by
@@ -5815,7 +6181,7 @@ <h3 class="heading settled" data-level="10.1" id="sctn-appid-extension"><span cl
        <p>Let <var>output</var> be the Boolean value <code>false</code>.</p>
       <li data-md>
        <p>When <a href="#assertionCreationDataCreation">creating assertionCreationData</a>,
-if the <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertion</a> was created by a U2F authenticator with the U2F application parameter set to the SHA-256 hash of <var>appId</var> instead of the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④④">RP ID</a>, set <var>output</var> to <code>true</code>.</p>
+if the <a data-link-type="dfn" href="#assertion" id="ref-for-assertion④">assertion</a> was created by a U2F authenticator with the U2F application parameter set to the SHA-256 hash of <var>appId</var> instead of the SHA-256 hash of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑥">RP ID</a>, set <var>output</var> to <code>true</code>.</p>
      </ol>
    </dl>
    <p class="note" role="note"><span>Note:</span> In practice, several implementations do not implement steps four and onward of the
@@ -5824,9 +6190,9 @@ <h3 class="heading settled" data-level="10.1" id="sctn-appid-extension"><span cl
    <dl>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥④">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#rpidhash" id="ref-for-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑤">RP ID</a>.</p>
+     <p>Returns the value of <var>output</var>. If true, the <var>AppID</var> was used and thus, when <a href="#rp-op-verifying-assertion-step-rpid-hash">verifying the assertion</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> MUST expect the <code><a data-link-type="dfn" href="#authdata-rpidhash" id="ref-for-authdata-rpidhash⑤">rpIdHash</a></code> to be the hash of the <var>AppID</var>, not the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑦">RP ID</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑤"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑤"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appid"></a></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑥"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appid"><code><c- g>appid</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appid"></a></dfn>;
 };
 </pre>
     <dt data-md>Authenticator extension input
@@ -5839,9 +6205,9 @@ <h3 class="heading settled" data-level="10.1" id="sctn-appid-extension"><span cl
     <dd data-md>
      <p>None.</p>
    </dl>
-   <h3 class="heading settled" data-level="10.2" id="sctn-appid-exclude-extension"><span class="secno">10.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h3>
-   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③④">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi">[FIDOU2FJavaScriptAPI]</a>.</p>
-   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑤">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑦">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⓪">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
+   <h4 class="heading settled" data-level="10.1.2" id="sctn-appid-exclude-extension"><span class="secno">10.1.2. </span><span class="content">FIDO AppID Exclusion Extension (appidExclude)</span><a class="self-link" href="#sctn-appid-exclude-extension"></a></h4>
+   <p>This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi">[FIDOU2FJavaScriptAPI]</a>.</p>
+   <p>During a transition from the FIDO U2F JavaScript API, a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> may have a population of users with legacy credentials already registered. The <a href="#sctn-appid-extension">appid</a> extension allows the sign-in flow to be transitioned smoothly but, when transitioning the registration flow, the <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑤">excludeCredentials</a> field will not be effective in excluding authenticators with legacy credentials because its contents are taken to be WebAuthn credentials. This extension directs <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platforms</a> to consider the contents of <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑥">excludeCredentials</a> as both WebAuthn and legacy FIDO credentials. Note that U2F key handles commonly use <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">base64url encoding</a> but must be decoded to their binary form when used in <a href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials⑦">excludeCredentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
@@ -5871,7 +6237,7 @@ <h3 class="heading settled" data-level="10.2" id="sctn-appid-exclude-extension">
         <li data-md>
          <p>Pass <var>facetId</var> and <var>appId</var> to the FIDO algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">determining if a caller’s
 FacetID is authorized for an AppID</a>. If the latter algorithm rejects <var>appId</var> then
-return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑧">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
+return a "<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#securityerror" id="ref-for-securityerror⑤">SecurityError</a></code>" <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> and terminate the <a href="#sctn-createCredential">creating a new credential</a> algorithm as well as these steps.</p>
          <p class="note" role="note"><span>Note:</span> In practice, several implementations do not implement steps four and onward of the algorithm for <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid" id="ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">determining if a caller’s FacetID is authorized for an AppID</a>. Instead, in step three, the comparison on the host is relaxed to accept hosts on the <a data-link-type="dfn" href="https://url.spec.whatwg.org/#host-same-site" id="ref-for-host-same-site②">same site</a>.</p>
         <li data-md>
          <p>Otherwise, continue with normal processing.</p>
@@ -5880,7 +6246,7 @@ <h3 class="heading settled" data-level="10.2" id="sctn-appid-exclude-extension">
        <p>Just prior to <a href="#CreateCred-InvokeAuthnrMakeCred">invoking authenticatorMakeCredential</a> perform these steps:</p>
        <ol>
         <li data-md>
-         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑧">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①②">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
+         <p>If <var>authenticator</var> supports the U2F protocol <a data-link-type="biblio" href="#biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]</a>, then <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-iterate" id="ref-for-list-iterate①⑨">for each</a> <a href="#dictdef-publickeycredentialdescriptor" id="ref-for-dictdef-publickeycredentialdescriptor①④">credential descriptor</a> <var>C</var> in <var>excludeCredentialDescriptorList</var>:</p>
          <ol>
           <li data-md>
            <p>Check whether <var>C</var> was created using U2F on <var>authenticator</var> by sending a <code>U2F_AUTHENTICATE</code> message to <var>authenticator</var> whose "five parts" are set to the following values:</p>
@@ -5896,10 +6262,10 @@ <h3 class="heading settled" data-level="10.2" id="sctn-appid-exclude-extension">
              <p>SHA-256 hash of <var>appId</var></p>
             <dt data-md><var>key handle length</var>
             <dd data-md>
-             <p>The length of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑧">id</a></code></code> (in bytes)</p>
+             <p>The length of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①①">id</a></code></code> (in bytes)</p>
             <dt data-md><var>key handle</var>
             <dd data-md>
-             <p>The value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id⑨">id</a></code></code>, i.e., the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑤">credential id</a>.</p>
+             <p>The value of <code><var>C</var>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialdescriptor-id" id="ref-for-dom-publickeycredentialdescriptor-id①②">id</a></code></code>, i.e., the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential id</a>.</p>
            </dl>
           <li data-md>
            <p>If <var>authenticator</var> responds with <code>message:error:test-of-user-presence-required</code> (i.e., success):
@@ -5916,9 +6282,9 @@ <h3 class="heading settled" data-level="10.2" id="sctn-appid-exclude-extension">
      </ol>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑥">Relying Party</a> that the extension was acted upon.</p>
+     <p>Returns the value <code>true</code> to indicate to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Party</a> that the extension was acted upon.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑥"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑥"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appidexclude"></a></dfn>;
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientoutputs-appidexclude"><code><c- g>appidExclude</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-appidexclude"></a></dfn>;
 };
 </pre>
     <dt data-md>Authenticator extension input
@@ -5931,165 +6297,192 @@ <h3 class="heading settled" data-level="10.2" id="sctn-appid-exclude-extension">
     <dd data-md>
      <p>None.</p>
    </dl>
-   <h3 class="heading settled" data-level="10.3" id="sctn-uvm-extension"><span class="secno">10.3. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-verification-method">User Verification Method</dfn> Extension (uvm)</span><a class="self-link" href="#sctn-uvm-extension"></a></h3>
-   <p>This extension enables use of a user verification method.</p>
+   <h4 class="heading settled" data-level="10.1.3" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.1.3. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h4>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑦">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
+   <p>At this time, one <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential property</a> is defined: the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property①">resident key credential property</a> (i.e., <a data-link-type="dfn" href="#credentialpropertiesoutput-client-side-discoverable-credential-property" id="ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a>).</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
-     <p><code>uvm</code></p>
+     <p><code>credProps</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension⑨">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">Authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">Registration</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑦">Relying Party</a>.</p>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a>.</p>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑧"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑦"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-uvm"></a></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-credprops"></a></dfn>;
 };
 </pre>
     <dt data-md>Client extension processing
     <dd data-md>
-     <p>None, except creating the authenticator extension input from the client extension input.</p>
+     <p>None, other than to report on credential properties in the output.</p>
     <dt data-md>Client extension output
     <dd data-md>
-     <p>Returns a JSON array of 3-element arrays of numbers that encodes the factors in the authenticator extension output.</p>
-<pre class="idl highlight def"><c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑤"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long④"><c- b>unsigned</c-> <c- b>long</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-uvmentry"><code><c- g>UvmEntry</c-></code></dfn>;
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence⑥"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-uvmentry" id="ref-for-typedefdef-uvmentry"><c- n>UvmEntry</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-uvmentries"><code><c- g>UvmEntries</c-></code></dfn>;
+     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑥">Set</a> <code><a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults①">clientExtensionResults</a>["<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>"]["rk"]</code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> operation.</p>
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①"><c- g>rk</c-></a>;
+};
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑦"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a data-link-type="idl-name" href="#typedefdef-uvmentries" id="ref-for-typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="UvmEntries " id="dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-uvm"></a></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-credentialpropertiesoutput" id="ref-for-dictdef-credentialpropertiesoutput"><c- n>CredentialPropertiesOutput</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="CredentialPropertiesOutput " id="dom-authenticationextensionsclientoutputs-credprops"><code><c- g>credProps</c-></code></dfn>;
 };
 </pre>
+     <div>
+      <dl>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪">boolean</a></span>
+       <dd data-md>
+        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn> (i.e., <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</dfn>),
+is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑤">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credential</a>.
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a>.
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
+If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
+        <p class="note" role="note"><span>Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential③">non-discoverable credential</a>.</p>
+      </dl>
+     </div>
     <dt data-md>Authenticator extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code>, encoded in CBOR (major type 7, value 21).</p>
-<pre>$$extensionInput //= (
-  uvm: true,
-)
-</pre>
+     <p>None.</p>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②①⑨">authenticator</a> sets the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑤">authenticator extension output</a> to be one or more user verification methods indicating the method(s) used
-by the user to authorize the operation, as defined below. This extension can be added to attestation objects and assertions.</p>
+     <p>None.</p>
     <dt data-md>Authenticator extension output
     <dd data-md>
-     <p>Authenticators can report up to 3 different user verification methods (factors) used in a single authentication instance,
-using the CBOR syntax defined below:</p>
-<pre>$$extensionOutput //= (
-  uvm: [ 1*3 uvmEntry ],
-)
-
-uvmEntry = [
-               userVerificationMethod: uint .size 4,
-               keyProtectionType: uint .size 2,
-               matcherProtectionType: uint .size 2
-           ]
-</pre>
-     <p>The semantics of the fields in each <code>uvmEntry</code> are as follows:</p>
-     <dl>
-      <dt data-md>userVerificationMethod
-      <dd data-md>
-       <p>The authentication method/factor used by the authenticator to verify the user. Available values are defined in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods" id="ref-for-user-verification-methods">Section 3.1 User Verification Methods</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>.</p>
-      <dt data-md>keyProtectionType
-      <dd data-md>
-       <p>The method used by the authenticator to protect the FIDO registration private key material. Available values are defined
-in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types" id="ref-for-key-protection-types">Section 3.2 Key Protection Types</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>.</p>
-      <dt data-md>matcherProtectionType
-      <dd data-md>
-       <p>The method used by the authenticator to protect the matcher that performs user verification. Available values are defined
-in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types" id="ref-for-matcher-protection-types">Section 3.3 Matcher Protection Types</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>.</p>
-     </dl>
-     <p>If >3 factors can be used in an authentication instance the authenticator vendor MUST select the 3 factors it believes
-will be most relevant to the Server to include in the UVM.</p>
-     <p>Example for <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑦">authenticator data</a> containing one UVM extension for a multi-factor authentication instance where 2 factors
-were used:</p>
-<pre>...                    -- RP ID hash (32 bytes)
-81                     -- UP and ED set
-00 00 00 01            -- (initial) signature counter
-...                    -- all public key alg etc.
-A1                     -- extension: CBOR map of one element
-    63                 -- Key 1: CBOR text string of 3 bytes
-        75 76 6d       -- "uvm" [=UTF-8 encoded=] string
-    82                 -- Value 1: CBOR array of length 2 indicating two factor usage
-        83              -- Item 1: CBOR array of length 3
-            02           -- Subitem 1: CBOR integer for User Verification Method Fingerprint
-            04           -- Subitem 2: CBOR short for Key Protection Type TEE
-            02           -- Subitem 3: CBOR short for Matcher Protection Type TEE
-        83              -- Item 2: CBOR array of length 3
-            04           -- Subitem 1: CBOR integer for User Verification Method Passcode
-            01           -- Subitem 2: CBOR short for Key Protection Type Software
-            01           -- Subitem 3: CBOR short for Matcher Protection Type Software
-</pre>
+     <p>None.</p>
    </dl>
-   <h3 class="heading settled" data-level="10.4" id="sctn-authenticator-credential-properties-extension"><span class="secno">10.4. </span><span class="content">Credential Properties Extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="credprops">credProps</dfn>)</span><a class="self-link" href="#sctn-authenticator-credential-properties-extension"></a></h3>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑦">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⓪">registration extension</a> facilitates reporting certain <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties②">credential properties</a> known by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑧">client</a> to the requesting <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑤">WebAuthn Relying Party</a> upon creation of a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④①">public key credential source</a> as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①②">registration ceremony</a>.</p>
-   <p>At this time, one <a data-link-type="dfn" href="#credential-properties" id="ref-for-credential-properties③">credential property</a> is defined: the <a data-link-type="dfn" href="#credentialpropertiesoutput-resident-key-credential-property" id="ref-for-credentialpropertiesoutput-resident-key-credential-property①">resident key credential property</a> (i.e., <a data-link-type="dfn" href="#credentialpropertiesoutput-client-side-discoverable-credential-property" id="ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a>).</p>
+   <h4 class="heading settled" data-level="10.1.4" id="prf-extension"><span class="secno">10.1.4. </span><span class="content">Pseudo-random function extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="prf">prf</dfn>)</span><a class="self-link" href="#prf-extension"></a></h4>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension⑨">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Party</a> to evaluate outputs from a pseudo-random function (PRF) associated with a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credential</a>. The PRFs provided by this extension map from <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString④">USVString</a></code>s of any length to 32-byte <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑦">ArrayBuffer</a></code>s.</p>
+   <p>When requested, if a <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a> is created on an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticator</a> that supports this extension then either one or two freshly-seeded PRFs are associated with it. If two PRFs are associated then, when outputs are requested, one PRF is evaluated if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a> is performed and the other is evaluated if only a <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①③">user presence test</a> is performed. It is the responsibility of the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Party</a> to set the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification⑤">userVerification</a></code> parameter accordingly: <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Parties</a> SHOULD <em>consistently</em> use either the <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-required" id="ref-for-dom-userverificationrequirement-required⑧">required</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-discouraged" id="ref-for-dom-userverificationrequirement-discouraged⑤">discouraged</a></code> values of <code class="idl"><a data-link-type="idl" href="#enumdef-userverificationrequirement" id="ref-for-enumdef-userverificationrequirement⑥">UserVerificationRequirement</a></code> when using this extension, otherwise the outputs may vary for a given input. To avoid mistakes, the default value of <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred⑤">preferred</a></code> is prohibited when using this extension during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑤">assertion</a> because that could cause the PRF used to vary between operations if <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">user verification</a> is later enabled on an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a>.</p>
+   <p>As a motivating example, PRF outputs could be used as symmetric keys to encrypt user data. Such encrypted data would be inaccessible without the ability to get assertions from the associated <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a>. By using the provision below to evaluate the PRF at two inputs in a single <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> operation, the encryption key could be periodically rotated during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertions</a> by choosing a fresh, random input and reencrypting under the new output. If the evaluation inputs are unpredictable then even an attacker who could satisfy <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">user verification</a>, and who had time-limited access to the authenticator, could not learn the encryption key without also knowing the correct PRF input.</p>
+   <p>This extension is implemented on top of the <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> <code>hmac-secret</code> extension. It is a separate <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client extension</a> because <code>hmac-secret</code> requires that inputs and outputs be encrypted in a manner that only the user agent can perform, and to provide separation between uses by WebAuthn and any uses by the underlying platform. This separation is achieved by hashing the provided PRF inputs with a context string to prevent evaluation of the PRFs for arbitrary inputs.</p>
+   <p class="note" role="note"><span>Note:</span> this extension may be implemented for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticators</a> that do not use <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> so long as the behavior observed by a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> is identical.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
-     <p><code>credProps</code></p>
+     <p><code>prf</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①①">Registration</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
-     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑧">Relying Party</a>.</p>
-<pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑨"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑧"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-credprops"></a></dfn>;
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfvalues"><code><c- g>AuthenticationExtensionsPRFValues</c-></code></dfn> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑧"><c- b>ArrayBuffer</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFValues" data-dfn-type="dict-member" data-export data-type="ArrayBuffer " id="dom-authenticationextensionsprfvalues-first"><code><c- g>first</c-></code></dfn>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑨"><c- b>ArrayBuffer</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFValues" data-dfn-type="dict-member" data-export data-type="ArrayBuffer " id="dom-authenticationextensionsprfvalues-second"><code><c- g>second</c-></code></dfn>;
+};
+
+<c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfinputs"><code><c- g>AuthenticationExtensionsPRFInputs</c-></code></dfn> {
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues " href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval"><c- g>eval</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record" id="ref-for-idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑤"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues①"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues> " href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
+};
+
+<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs⑨"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfinputs" id="ref-for-dictdef-authenticationextensionsprfinputs"><c- n>AuthenticationExtensionsPRFInputs</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsPRFInputs " id="dom-authenticationextensionsclientinputs-prf"><code><c- g>prf</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-prf"></a></dfn>;
 };
 </pre>
-    <dt data-md>Client extension processing
+     <div>
+      <dl>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-eval"><code>eval</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues②">AuthenticationExtensionsPRFValues</a></span>
+       <dd data-md>
+        <p>One or two inputs on which to evaluate PRF. Not all <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticators</a> support evaluating the PRFs during credential creation so outputs may, or may not, be provided. If not, then an <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑧">assertion</a> is needed in order to obtain the outputs.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfinputs-evalbycredential"><code>evalByCredential</code></dfn>, <span> of type record&lt;<a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-USVString" id="ref-for-idl-USVString⑥">USVString</a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues③">AuthenticationExtensionsPRFValues</a>></span>
+       <dd data-md>
+        <p>A record mapping <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">base64url encoded</a> <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> to PRF inputs to evaluate for that credential. Only applicable during <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑨">assertions</a> when <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code> is not empty.</p>
+      </dl>
+     </div>
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①③">registration</a>)
     <dd data-md>
-     <p>None, other than to report on credential properties in the output.</p>
+     <ol>
+      <li data-md>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">evalByCredential</a></code> is present, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
+      <li data-md>
+       <p>Set <code>hmac-secret</code> to <code>true</code> in the authenticator extensions input.</p>
+      <li data-md>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval①">eval</a></code> is present and a future extension to <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> permits evaluation of the PRF at creation time, configure <code>hmac-secret</code> inputs accordingly:</p>
+       <ul>
+        <li data-md>
+         <p>Let <code>salt1</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval②">eval</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first">first</a></code>)</code>.</p>
+        <li data-md>
+         <p>If <code><code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval③">eval</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second">second</a></code></code> is present, let <code>salt2</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval④">eval</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second①">second</a></code>)</code>.</p>
+       </ul>
+      <li data-md>
+       <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled">enabled</a></code> to the value of <code>hmac-secret</code> in the authenticator extensions output. If not present, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled①">enabled</a></code> to <code>false</code>.</p>
+      <li data-md>
+       <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results">results</a></code> to the decrypted PRF result(s), if any.</p>
+     </ol>
+   </dl>
+   <p class="note" role="note"><span>Note:</span> If PRF results are obtained during <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a> then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Party</a> MUST inspect the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv⑨">UV</a> bit in the <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④⓪">flags</a> of the response in order to determine the correct value of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification⑥">userVerification</a></code> for future <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①⓪">assertions</a>. Otherwise results from <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①①">assertions</a> may be inconsistent with those from the <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a>.</p>
+   <dl>
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication</a>)
+    <dd data-md>
+     <ol>
+      <li data-md>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-userverification" id="ref-for-dom-publickeycredentialrequestoptions-userverification⑦">userVerification</a></code> has the value <code class="idl"><a data-link-type="idl" href="#dom-userverificationrequirement-preferred" id="ref-for-dom-userverificationrequirement-preferred⑥">preferred</a></code>, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②③">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
+      <li data-md>
+       <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">evalByCredential</a></code> is not empty but <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code> is empty, return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②④">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
+      <li data-md>
+       <p>Initialize the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-prf" id="ref-for-dom-authenticationextensionsclientoutputs-prf">prf</a></code> extension output to an empty dictionary.</p>
+      <li data-md>
+       <p>Let <var>ev</var> be null, and try to find any applicable PRF input(s):</p>
+       <ol>
+        <li data-md>
+         <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">evalByCredential</a></code> is present and <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-exists" id="ref-for-map-exists⑥">contains</a> an <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-entry" id="ref-for-map-entry①">entry</a> whose <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-key" id="ref-for-map-key">key</a> is the <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">base64url encoding</a> of the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">credential ID</a> that will be returned, let <var>ev</var> be the <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-value" id="ref-for-map-value">value</a> of that entry.</p>
+        <li data-md>
+         <p>If <var>ev</var> is null and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑤">eval</a></code> is present, then let <var>ev</var> be the value of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑥">eval</a></code>.</p>
+       </ol>
+      <li data-md>
+       <p>If <var>ev</var> is not null:</p>
+       <ol>
+        <li data-md>
+         <p>Let <code>salt1</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-first" id="ref-for-dom-authenticationextensionsprfvalues-first①">first</a></code>)</code>.</p>
+        <li data-md>
+         <p>If <code><var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second②">second</a></code></code> is present, let <code>salt2</code> be the value of <code>SHA-256(UTF8Encode("WebAuthn PRF") || 0x00 || <var>ev</var>.<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfvalues-second" id="ref-for-dom-authenticationextensionsprfvalues-second③">second</a></code>)</code>.</p>
+        <li data-md>
+         <p>Send an <code>hmac-secret</code> extension to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a> using the values of <code>salt1</code> and, if set, <code>salt2</code> as the parameters of the same name in that process.</p>
+        <li data-md>
+         <p>Decrypt the extension result and set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results①">results</a></code> to the PRF result(s), if any.</p>
+       </ol>
+     </ol>
+    <dt data-md>Authenticator extension input / processing / output
+    <dd data-md>
+     <p><a data-link-type="dfn" href="#prf" id="ref-for-prf">This extension</a> uses the <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> <code>hmac-secret</code> extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Parties</a>.</p>
     <dt data-md>Client extension output
     <dd data-md>
-     <p><a data-link-type="dfn" href="https://infra.spec.whatwg.org/#map-set" id="ref-for-map-set⑤">Set</a> <code><a data-link-type="dfn" href="#credentialcreationdata-clientextensionresults" id="ref-for-credentialcreationdata-clientextensionresults①">clientExtensionResults</a>["<code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-credprops" id="ref-for-dom-authenticationextensionsclientoutputs-credprops">credProps</a></code>"]["rk"]</code> to the value of the <var>requireResidentKey</var> parameter that was used in the <a href="#CreateCred-InvokeAuthnrMakeCred">invocation</a> of the <a data-link-type="dfn" href="#authenticatormakecredential" id="ref-for-authenticatormakecredential①⑨">authenticatorMakeCredential</a> operation.</p>
-<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean⑨"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk①"><c- g>rk</c-></a>;
+<pre class="idl highlight def"><c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></dfn> {
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionsprfoutputs-enabled" id="ref-for-dom-authenticationextensionsprfoutputs-enabled②"><c- g>enabled</c-></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues④"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues " href="#dom-authenticationextensionsprfoutputs-results" id="ref-for-dom-authenticationextensionsprfoutputs-results②"><c- g>results</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑧"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-credentialpropertiesoutput" id="ref-for-dictdef-credentialpropertiesoutput"><c- n>CredentialPropertiesOutput</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="CredentialPropertiesOutput " id="dom-authenticationextensionsclientoutputs-credprops"><code><c- g>credProps</c-></code></dfn>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfoutputs" id="ref-for-dictdef-authenticationextensionsprfoutputs"><c- n>AuthenticationExtensionsPRFOutputs</c-></a> <dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="AuthenticationExtensionsPRFOutputs " id="dom-authenticationextensionsclientoutputs-prf"><code><c- g>prf</c-></code></dfn>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dict-member" data-export id="dom-credentialpropertiesoutput-rk"><code>rk</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⓪">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-enabled"><code>enabled</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①②">boolean</a></span>
        <dd data-md>
-        <p>This OPTIONAL property, known abstractly as the <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-resident-key-credential-property">resident key credential property</dfn> (i.e., <dfn class="dfn-paneled" data-dfn-for="CredentialPropertiesOutput" data-dfn-type="dfn" data-noexport id="credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</dfn>),
-is a Boolean value indicating whether the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②①">PublicKeyCredential</a></code> returned as a result of a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①③">registration ceremony</a> is a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①④">client-side discoverable credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk②">rk</a></code> is <code>true</code>, the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①②">discoverable credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk③">rk</a></code> is <code>false</code>, the credential is a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①②">server-side credential</a>.
-If <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk④">rk</a></code> is not present, it is not known whether the credential is a <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①③">discoverable credential</a> or a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①③">server-side credential</a>.</p>
-        <p class="note" role="note"><span>Note:</span> some <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⓪">authenticators</a> create <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①④">discoverable credentials</a> even when not requested by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑧">client platform</a>. Because of this, <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform④⑨">client platforms</a> may be forced to omit the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑤">rk</a></code> property because they lack the assurance to be able to set it to <code>false</code>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑥⑨">Relying Parties</a> should assume that, if the <code>credProps</code> extension is supported, then <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⓪">client platforms</a> will endeavour to populate the <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑥">rk</a></code> property. Therefore a missing <code class="idl"><a data-link-type="idl" href="#dom-credentialpropertiesoutput-rk" id="ref-for-dom-credentialpropertiesoutput-rk⑦">rk</a></code> indicates that the created credential is most likely a <a data-link-type="dfn" href="#non-discoverable-credential" id="ref-for-non-discoverable-credential③">non-discoverable credential</a>.</p>
+        <p><code>true</code> if, and only if, the one or two PRFs are available for use with the created credential. This is only reported during <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> and is not present in the case of <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①④">authentication</a>.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsPRFOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionsprfoutputs-results"><code>results</code></dfn>, <span> of type <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues" id="ref-for-dictdef-authenticationextensionsprfvalues⑤">AuthenticationExtensionsPRFValues</a></span>
+       <dd data-md>
+        <p>The results of evaluating the PRF for the inputs given in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑦">eval</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-evalbycredential" id="ref-for-dom-authenticationextensionsprfinputs-evalbycredential④">evalByCredential</a></code>. Outputs may not be available during <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a>; see comments in <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsprfinputs-eval" id="ref-for-dom-authenticationextensionsprfinputs-eval⑧">eval</a></code>.</p>
       </dl>
      </div>
-    <dt data-md>Authenticator extension input
-    <dd data-md>
-     <p>None.</p>
-    <dt data-md>Authenticator extension processing
-    <dd data-md>
-     <p>None.</p>
-    <dt data-md>Authenticator extension output
-    <dd data-md>
-     <p>None.</p>
    </dl>
-   <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><span class="secno">10.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h3>
-   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑧">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⓪">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⓪">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②①">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦①">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦②">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
-   <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦③">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
-   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①③">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦④">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①①">authentication extension</a>.</p>
+   <h4 class="heading settled" data-level="10.1.5" id="sctn-large-blob-extension"><span class="secno">10.1.5. </span><span class="content">Large blob storage extension (<dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="largeblob">largeBlob</dfn>)</span><a class="self-link" href="#sctn-large-blob-extension"></a></h4>
+   <p>This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①①">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Party</a> to store opaque data associated with a credential. Since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticators</a> can only store small amounts of data, and most <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Parties</a> are online services that can store arbitrary amounts of state for a user, this is only useful in specific cases. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> might wish to issue certificates rather than run a centralised authentication service.</p>
+   <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a> can assume that the opaque data will be compressed when being written to a space-limited device and so need not compress it themselves.</p>
+   <p>Since a certificate system needs to sign over the public key of the credential, and that public key is only available after creation, this extension does not add an ability to write blobs in the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">registration</a> context. However, <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Parties</a> SHOULD use the <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration extension</a> when creating the credential if they wish to later use the <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication extension</a>.</p>
    <p>Since certificates are sizable relative to the storage capabilities of typical authenticators, user agents SHOULD consider what indications and confirmations are suitable to best guide the user in allocating this limited resource and prevent abuse.</p>
    <p class="note" role="note"><span>Note:</span> In order to interoperate, user agents storing large blobs on authenticators using <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> are expected to use the provisions detailed in that specification for storing <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob">large, per-credential blobs</a>.</p>
-   <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credentials</a>,
+   <p class="note" role="note"><span>Note:</span> <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②④">Roaming authenticators</a> that use <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> as their cross-platform transport protocol only support this <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">Large Blob</a> extension for <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑤">discoverable credentials</a>,
 and might return an error unless <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-authenticatorselection" id="ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①①">authenticatorSelection</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-authenticatorselectioncriteria-residentkey" id="ref-for-dom-authenticatorselectioncriteria-residentkey⑦">residentKey</a></code></code> is set to <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-preferred" id="ref-for-dom-residentkeyrequirement-preferred④">preferred</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-residentkeyrequirement-required" id="ref-for-dom-residentkeyrequirement-required⑤">required</a></code>.
-However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②②">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credentials</a>.</p>
+However, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticators</a> that do not utilize <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a> do not necessarily restrict this extension to <a data-link-type="dfn" href="#discoverable-credential" id="ref-for-discoverable-credential①⑥">discoverable credentials</a>.</p>
    <dl>
     <dt data-md>Extension identifier
     <dd data-md>
      <p><code>largeBlob</code></p>
     <dt data-md>Operation applicability
     <dd data-md>
-     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑤">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①②">authentication</a></p>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication</a></p>
     <dt data-md>Client extension input
     <dd data-md>
 <pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①⓪"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -6102,32 +6495,32 @@ <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><sp
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargeblobinputs"><code><c- g>AuthenticationExtensionsLargeBlobInputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑧"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①①"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑤"><c- b>DOMString</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="DOMString " href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support"><c- g>support</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①③"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read"><c- g>read</c-></a>;
     <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①⓪"><c- n>BufferSource</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="BufferSource " href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write"><c- g>write</c-></a>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString③⑨">DOMString</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-support"><code>support</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-DOMString" id="ref-for-idl-DOMString⑤⑥">DOMString</a></span>
        <dd data-md>
-        <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑥">registration</a>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①②">boolean</a></span>
+        <p>A DOMString that takes one of the values of <code class="idl"><a data-link-type="idl" href="#enumdef-largeblobsupport" id="ref-for-enumdef-largeblobsupport">LargeBlobSupport</a></code>. (See <a href="#sct-domstring-backwards-compatibility">§ 2.1.1 Enumerations as DOMString types</a>.) Only valid during <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a>.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-read"><code>read</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑤">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①③">authentication</a>.</p>
+        <p>A boolean that indicates that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> would like to fetch the previously-written blob associated with the asserted credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>.</p>
        <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobInputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargeblobinputs-write"><code>write</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#BufferSource" id="ref-for-BufferSource①①">BufferSource</a></span>
        <dd data-md>
-        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑥">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①④">authentication</a>.</p>
+        <p>An opaque byte string that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> wishes to store with the existing credential. Only valid during <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication</a>.</p>
       </dl>
      </div>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑦">registration</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration</a>)
     <dd data-md>
      <ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read①">read</a></code> or <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write①">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException①⑨">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror③">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑤">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑦">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support①">support</a></code> is present and has the value <code class="idl"><a data-link-type="idl" href="#dom-largeblobsupport-required" id="ref-for-dom-largeblobsupport-required">required</a></code>:</p>
@@ -6136,7 +6529,7 @@ <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><sp
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported">supported</a></code> to <code>true</code>.</p>
          <p class="note" role="note"><span>Note:</span> This is in anticipation of an authenticator capable of storing large blobs becoming available. It occurs during extension processing in Step 11 of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot⑨">[[Create]]()</a></code>. The <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionslargebloboutputs" id="ref-for-dictdef-authenticationextensionslargebloboutputs">AuthenticationExtensionsLargeBlobOutputs</a></code> will be abandoned if no satisfactory authenticator becomes available.</p>
         <li data-md>
-         <p>If a <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator">candidate authenticator</a> becomes available (Step 19 of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①⓪">[[Create]]()</a></code>) then, before evaluating any <code><var>options</var></code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑤">continue</a> (i.e. ignore the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator①">candidate authenticator</a>) if the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator②">candidate authenticator</a> is not capable of storing large blobs.</p>
+         <p>If a <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator">candidate authenticator</a> becomes available (Step 19 of <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①⓪">[[Create]]()</a></code>) then, before evaluating any <code><var>options</var></code>, <a data-link-type="dfn" href="https://infra.spec.whatwg.org/#iteration-continue" id="ref-for-iteration-continue①⑦">continue</a> (i.e. ignore the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator①">candidate authenticator</a>) if the <a data-link-type="dfn" href="#create-candidate-authenticator" id="ref-for-create-candidate-authenticator②">candidate authenticator</a> is not capable of storing large blobs.</p>
        </ol>
       <li data-md>
        <p>Otherwise (i.e. <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support②">support</a></code> is absent or has the value <code class="idl"><a data-link-type="idl" href="#dom-largeblobsupport-preferred" id="ref-for-dom-largeblobsupport-preferred">preferred</a></code>):</p>
@@ -6145,20 +6538,20 @@ <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><sp
          <p>If an <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator">authenticator is selected</a> and the <a data-link-type="dfn" href="#create-selected-authenticator" id="ref-for-create-selected-authenticator①">selected authenticator</a> supports large blobs, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported①">supported</a></code> to <code>true</code>, and <code>false</code> otherwise.</p>
        </ol>
      </ol>
-    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑤">authentication</a>)
+    <dt data-md>Client extension processing (<a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication</a>)
     <dd data-md>
      <ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-support" id="ref-for-dom-authenticationextensionslargeblobinputs-support③">support</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⓪">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror④">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑥">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑧">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If both <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read②">read</a></code> and <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write②">write</a></code> are present:</p>
        <ol>
         <li data-md>
-         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②①">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑤">NotSupportedError</a></code>”.</p>
+         <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑦">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑨">NotSupportedError</a></code>”.</p>
        </ol>
       <li data-md>
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read③">read</a></code> is present and has the value <code>true</code>:</p>
@@ -6166,7 +6559,7 @@ <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><sp
         <li data-md>
          <p>Initialize the <a data-link-type="dfn" href="#client-extension-output" id="ref-for-client-extension-output①⑧">client extension output</a>, <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-largeblob" id="ref-for-dom-authenticationextensionsclientoutputs-largeblob">largeBlob</a></code>.</p>
         <li data-md>
-         <p>If any authenticator indicates success (in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">[[DiscoverFromExternalSource]]()</a></code>), attempt to read any largeBlob data associated with the asserted credential.</p>
+         <p>If any authenticator indicates success (in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①③">[[DiscoverFromExternalSource]]()</a></code>), attempt to read any largeBlob data associated with the asserted credential.</p>
         <li data-md>
          <p>If successful, set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob">blob</a></code> to the result.</p>
          <p class="note" role="note"><span>Note:</span> if the read is not successful, <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionsclientoutputs-largeblob" id="ref-for-dom-authenticationextensionsclientoutputs-largeblob①">largeBlob</a></code> will be present in <code class="idl"><a data-link-type="idl" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs⑨">AuthenticationExtensionsClientOutputs</a></code> but the <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob①">blob</a></code> member will not be present.</p>
@@ -6175,13 +6568,13 @@ <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><sp
        <p>If <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write③">write</a></code> is present:</p>
        <ol>
         <li data-md>
-         <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">allowCredentials</a></code> does not contain exactly one element:</p>
+         <p>If <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> does not contain exactly one element:</p>
          <ol>
           <li data-md>
-           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②②">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror⑥">NotSupportedError</a></code>”.</p>
+           <p>Return a <code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#idl-DOMException" id="ref-for-idl-DOMException②⑧">DOMException</a></code> whose name is “<code class="idl"><a data-link-type="idl" href="https://webidl.spec.whatwg.org/#notsupportederror" id="ref-for-notsupportederror①⓪">NotSupportedError</a></code>”.</p>
          </ol>
         <li data-md>
-         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②③">authenticator</a>, associated with the indicated credential.</p>
+         <p>If the <a href="#sctn-getAssertion">assertion</a> operation is successful, attempt to store the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write④">write</a></code> on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticator</a>, associated with the indicated credential.</p>
         <li data-md>
          <p>Set <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written">written</a></code> to <code>true</code> if successful and <code>false</code> otherwise.</p>
        </ol>
@@ -6193,27 +6586,119 @@ <h3 class="heading settled" data-level="10.5" id="sctn-large-blob-extension"><sp
 };
 
 <c- b>dictionary</c-> <dfn class="dfn-paneled idl-code" data-dfn-type="dictionary" data-export id="dictdef-authenticationextensionslargebloboutputs"><code><c- g>AuthenticationExtensionsLargeBlobOutputs</c-></code></dfn> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①③"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported②"><c- g>supported</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②④"><c- b>ArrayBuffer</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="ArrayBuffer " href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob②"><c- g>blob</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①④"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written①"><c- g>written</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-supported" id="ref-for-dom-authenticationextensionslargebloboutputs-supported②"><c- g>supported</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③⓪"><c- b>ArrayBuffer</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="ArrayBuffer " href="#dom-authenticationextensionslargebloboutputs-blob" id="ref-for-dom-authenticationextensionslargebloboutputs-blob②"><c- g>blob</c-></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑥"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-written" id="ref-for-dom-authenticationextensionslargebloboutputs-written①"><c- g>written</c-></a>;
 };
 </pre>
      <div>
       <dl>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-supported"><code>supported</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑤">boolean</a></span>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-supported"><code>supported</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑦">boolean</a></span>
        <dd data-md>
-        <p><code>true</code> if, and only if, the created credential supports storing large blobs. Only present in <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑧">registration</a> outputs.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-blob"><code>blob</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer②⑤">ArrayBuffer</a></span>
+        <p><code>true</code> if, and only if, the created credential supports storing large blobs. Only present in <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⓪">registration</a> outputs.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-blob"><code>blob</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer" id="ref-for-idl-ArrayBuffer③①">ArrayBuffer</a></span>
        <dd data-md>
-        <p>The opaque byte string that was associated with the credential identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid③">rawId</a></code>. Only valid if <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read④">read</a></code> was <code>true</code>.</p>
-       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑥">boolean</a></span>
+        <p>The opaque byte string that was associated with the credential identified by <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-rawid" id="ref-for-dom-publickeycredential-rawid⑤">rawId</a></code>. Only valid if <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-read" id="ref-for-dom-authenticationextensionslargeblobinputs-read④">read</a></code> was <code>true</code>.</p>
+       <dt data-md><dfn class="dfn-paneled idl-code" data-dfn-for="AuthenticationExtensionsLargeBlobOutputs" data-dfn-type="dict-member" data-export id="dom-authenticationextensionslargebloboutputs-written"><code>written</code></dfn>, <span> of type <a data-link-type="idl-name" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑧">boolean</a></span>
        <dd data-md>
-        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②④">authenticator</a>, associated with the specified credential.</p>
+        <p>A boolean that indicates that the contents of <code class="idl"><a data-link-type="idl" href="#dom-authenticationextensionslargeblobinputs-write" id="ref-for-dom-authenticationextensionslargeblobinputs-write⑤">write</a></code> were successfully stored on the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a>, associated with the specified credential.</p>
       </dl>
      </div>
     <dt data-md>Authenticator extension processing
     <dd data-md>
-     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑦">Relying Parties</a>.</p>
+     <p><a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">This extension</a> directs the user-agent to cause the large blob to be stored on, or retrieved from, the authenticator. It thus does not specify any direct authenticator interaction for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Parties</a>.</p>
+   </dl>
+   <h3 class="heading settled" data-level="10.2" id="sctn-defined-authenticator-extensions"><span class="secno">10.2. </span><span class="content">Authenticator Extensions</span><a class="self-link" href="#sctn-defined-authenticator-extensions"></a></h3>
+   <p>This section defines extensions that are both <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①②">client extensions</a> and <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extensions</a>.</p>
+   <h4 class="heading settled" data-level="10.2.1" id="sctn-uvm-extension"><span class="secno">10.2.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="user-verification-method">User Verification Method</dfn> Extension (uvm)</span><a class="self-link" href="#sctn-uvm-extension"></a></h4>
+   <p>This extension enables use of a user verification method.</p>
+   <dl>
+    <dt data-md>Extension identifier
+    <dd data-md>
+     <p><code>uvm</code></p>
+    <dt data-md>Operation applicability
+    <dd data-md>
+     <p><a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">Registration</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">Authentication</a></p>
+    <dt data-md>Client extension input
+    <dd data-md>
+     <p>The Boolean value <code>true</code> to indicate that this extension is requested by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a>.</p>
+<pre class="idl highlight def"><c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs" id="ref-for-dictdef-authenticationextensionsclientinputs①①"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean" id="ref-for-idl-boolean①⑨"><c- b>boolean</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientInputs" data-dfn-type="dict-member" data-export data-type="boolean " id="dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientinputs-uvm"></a></dfn>;
+};
+</pre>
+    <dt data-md>Client extension processing
+    <dd data-md>
+     <p>None, except creating the authenticator extension input from the client extension input.</p>
+    <dt data-md>Client extension output
+    <dd data-md>
+     <p>Returns a JSON array of 3-element arrays of numbers that encodes the factors in the authenticator extension output.</p>
+<pre class="idl highlight def"><c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①⓪"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long" id="ref-for-idl-unsigned-long⑥"><c- b>unsigned</c-> <c- b>long</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-uvmentry"><code><c- g>UvmEntry</c-></code></dfn>;
+<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence" id="ref-for-idl-sequence①①"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-uvmentry" id="ref-for-typedefdef-uvmentry"><c- n>UvmEntry</c-></a>> <dfn class="dfn-paneled idl-code" data-dfn-type="typedef" data-export id="typedefdef-uvmentries"><code><c- g>UvmEntries</c-></code></dfn>;
+
+<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs" id="ref-for-dictdef-authenticationextensionsclientoutputs①①"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
+  <a data-link-type="idl-name" href="#typedefdef-uvmentries" id="ref-for-typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <dfn class="idl-code" data-dfn-for="AuthenticationExtensionsClientOutputs" data-dfn-type="dict-member" data-export data-type="UvmEntries " id="dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code><a class="self-link" href="#dom-authenticationextensionsclientoutputs-uvm"></a></dfn>;
+};
+</pre>
+    <dt data-md>Authenticator extension input
+    <dd data-md>
+     <p>The Boolean value <code>true</code>, encoded in CBOR (major type 7, value 21).</p>
+<pre>$$extensionInput //= (
+  uvm: true,
+)
+</pre>
+    <dt data-md>Authenticator extension processing
+    <dd data-md>
+     <p>The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> sets the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑤">authenticator extension output</a> to be one or more user verification methods indicating the method(s) used
+by the user to authorize the operation, as defined below. This extension can be added to attestation objects and assertions.</p>
+    <dt data-md>Authenticator extension output
+    <dd data-md>
+     <p>Authenticators can report up to 3 different user verification methods (factors) used in a single authentication instance,
+using the CBOR syntax defined below:</p>
+<pre>$$extensionOutput //= (
+  uvm: [ 1*3 uvmEntry ],
+)
+
+uvmEntry = [
+               userVerificationMethod: uint .size 4,
+               keyProtectionType: uint .size 2,
+               matcherProtectionType: uint .size 2
+           ]
+</pre>
+     <p>The semantics of the fields in each <code>uvmEntry</code> are as follows:</p>
+     <dl>
+      <dt data-md>userVerificationMethod
+      <dd data-md>
+       <p>The authentication method/factor used by the authenticator to verify the user. Available values are defined in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods" id="ref-for-user-verification-methods">Section 3.1 User Verification Methods</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>.</p>
+      <dt data-md>keyProtectionType
+      <dd data-md>
+       <p>The method used by the authenticator to protect the FIDO registration private key material. Available values are defined
+in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types" id="ref-for-key-protection-types">Section 3.2 Key Protection Types</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>.</p>
+      <dt data-md>matcherProtectionType
+      <dd data-md>
+       <p>The method used by the authenticator to protect the matcher that performs user verification. Available values are defined
+in <a data-link-type="dfn" href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types" id="ref-for-matcher-protection-types">Section 3.3 Matcher Protection Types</a> of <a data-link-type="biblio" href="#biblio-fido-registry">[FIDO-Registry]</a>.</p>
+     </dl>
+     <p>If >3 factors can be used in an authentication instance the authenticator vendor MUST select the 3 factors it believes
+will be most relevant to the Server to include in the UVM.</p>
+     <p>Example for <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑨">authenticator data</a> containing one UVM extension for a multi-factor authentication instance where 2 factors
+were used:</p>
+<pre>...                    -- RP ID hash (32 bytes)
+81                     -- UP and ED set
+00 00 00 01            -- (initial) signature counter
+...                    -- all public key alg etc.
+A1                     -- extension: CBOR map of one element
+    63                 -- Key 1: CBOR text string of 3 bytes
+        75 76 6d       -- "uvm" [=UTF-8 encoded=] string
+    82                 -- Value 1: CBOR array of length 2 indicating two factor usage
+        83              -- Item 1: CBOR array of length 3
+            02           -- Subitem 1: CBOR integer for User Verification Method Fingerprint
+            04           -- Subitem 2: CBOR short for Key Protection Type TEE
+            02           -- Subitem 3: CBOR short for Matcher Protection Type TEE
+        83              -- Item 2: CBOR array of length 3
+            04           -- Subitem 1: CBOR integer for User Verification Method Passcode
+            01           -- Subitem 2: CBOR short for Key Protection Type Software
+            01           -- Subitem 3: CBOR short for Matcher Protection Type Software
+</pre>
    </dl>
    <h2 class="heading settled" data-level="11" id="sctn-automation"><span class="secno">11. </span><span class="content">User Agent Automation</span><a class="self-link" href="#sctn-automation"></a></h2>
    <p>For the purposes of user agent automation and <a data-link-type="dfn" href="#web-application" id="ref-for-web-application④">web application</a> testing, this document defines a number of <a data-link-type="biblio" href="#biblio-webdriver">[WebDriver]</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command">extension commands</a>.</p>
@@ -6251,7 +6736,7 @@ <h3 class="heading settled" data-level="11.1" id="sctn-automation-webdriver-capa
      <p>Otherwise, the match is successful.</p>
    </ol>
    <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension-capabilities"><span class="secno">11.1.1. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="authenticator-extension-capabilities">Authenticator Extension Capabilities</dfn></span><a class="self-link" href="#sctn-authenticator-extension-capabilities"></a></h4>
-   <p>Additionally, <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-capability" id="ref-for-dfn-extension-capability①">extension capabilities</a> are defined for every <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①①">authenticator extension</a> (i.e. those defining <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing⑤">authenticator extension processing</a>) defined in this specification:</p>
+   <p>Additionally, <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-capability" id="ref-for-dfn-extension-capability①">extension capabilities</a> are defined for every <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator extension</a> (i.e. those defining <a data-link-type="dfn" href="#authenticator-extension-processing" id="ref-for-authenticator-extension-processing⑤">authenticator extension processing</a>) defined in this specification:</p>
    <figure class="table" id="table-virtualAuthenticatorsExtensionsWebdriverCapability">
     <table class="data">
      <thead>
@@ -6266,16 +6751,21 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
        <td><code>"webauthn:extension:uvm"</code>
        <td>boolean
        <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node②">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method">User Verification Method</a> extension.
+      <tr>
+       <td>Pseudo-Random Function Extension Support
+       <td><code>"webauthn:extension:prf"</code>
+       <td>boolean
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node③">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#prf" id="ref-for-prf①">prf</a> extension.
       <tr>
        <td>Large Blob Storage Extension Support
        <td><code>"webauthn:extension:largeBlob"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node③">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob①">largeBlob</a> extension.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node④">endpoint node</a> WebAuthn WebDriver implementation supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob②">largeBlob</a> extension.
       <tr>
        <td>credBlob Extension Support
        <td><code>"webauthn:extension:credBlob"</code>
        <td>boolean
-       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node④">endpoint node</a> WebAuthn WebDriver implementation supports the <code>credBlob</code> extension defined in <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a>.
+       <td>Indicates whether the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑤">endpoint node</a> WebAuthn WebDriver implementation supports the <code>credBlob</code> extension defined in <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a>.
     </table>
    </figure>
    <p>When <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-validate-capabilities" id="ref-for-dfn-validate-capabilities①">validating capabilities</a>, the extension-specific substeps to validate an <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities">authenticator extension capability</a> <code>key</code> with <code>value</code> are the following:</p>
@@ -6288,12 +6778,12 @@ <h4 class="heading settled" data-level="11.1.1" id="sctn-authenticator-extension
    <p>When <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-matching-capabilities" id="ref-for-dfn-matching-capabilities①">matching capabilities</a>, the extension-specific steps to match an <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities①">authenticator extension capability</a> <code>key</code> with <code>value</code> are the following:</p>
    <ol>
     <li data-md>
-     <p>If <code>value</code> is <code>true</code> and the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑤">endpoint node</a> WebAuthn WebDriver implementation does not support the <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①②">authenticator extension</a> identified by the <code>key</code>,
+     <p>If <code>value</code> is <code>true</code> and the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑥">endpoint node</a> WebAuthn WebDriver implementation does not support the <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①④">authenticator extension</a> identified by the <code>key</code>,
 the match is unsuccessful.</p>
     <li data-md>
      <p>Otherwise, the match is successful.</p>
    </ol>
-   <p>User-Agents implementing defined <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①③">authenticator extensions</a> SHOULD implement the corresponding <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities②">authenticator extension capability</a>.</p>
+   <p>User-Agents implementing defined <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑤">authenticator extensions</a> SHOULD implement the corresponding <a data-link-type="dfn" href="#authenticator-extension-capabilities" id="ref-for-authenticator-extension-capabilities②">authenticator extension capability</a>.</p>
    <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authenticators"><span class="secno">11.2. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticators">Virtual Authenticators</dfn></span><a class="self-link" href="#sctn-automation-virtual-authenticators"></a></h3>
    <p>These WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command②">extension commands</a> create and interact with <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②">Virtual Authenticators</a>: software implementations of the <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model③">Authenticator Model</a>. <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators③">Virtual Authenticators</a> are stored in a <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="virtual-authenticator-database">Virtual Authenticator Database</dfn>.
 Each stored <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators④">virtual authenticator</a> has the following properties:</p>
@@ -6310,22 +6800,22 @@ <h3 class="heading settled" data-level="11.2" id="sctn-automation-virtual-authen
 authenticator simulates <a data-link-type="dfn" href="#platform-attachment" id="ref-for-platform-attachment④">platform attachment</a>. Otherwise, it simulates <a data-link-type="dfn" href="#cross-platform-attachment" id="ref-for-cross-platform-attachment⑤">cross-platform attachment</a>.</p>
     <dt data-md><var>hasResidentKey</var>
     <dd data-md>
-     <p>If set to <code>true</code> the authenticator will support <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑤">client-side discoverable credentials</a>.</p>
+     <p>If set to <code>true</code> the authenticator will support <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑥">client-side discoverable credentials</a>.</p>
     <dt data-md><var>hasUserVerification</var>
     <dd data-md>
-     <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④③">user verification</a>.</p>
+     <p>If set to <code>true</code>, the authenticator supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a>.</p>
     <dt data-md><var>isUserConsenting</var>
     <dd data-md>
-     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①③">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
+     <p>Determines the result of all <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②④">user consent</a> <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture②⑨">authorization gestures</a>, and by extension, any <a data-link-type="dfn" href="#test-of-user-presence" id="ref-for-test-of-user-presence①④">test of user presence</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑦">Virtual Authenticator</a>. If set to <code>true</code>, a <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑤">user consent</a> will always be granted. If set to <code>false</code>, it will not be granted.</p>
     <dt data-md><var>isUserVerified</var>
     <dd data-md>
-     <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④④">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑤">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
+     <p>Determines the result of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">User Verification</a> performed on the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑧">Virtual Authenticator</a>. If set to <code>true</code>, <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">User Verification</a> will always succeed. If set to <code>false</code>, it will fail.</p>
      <p class="note" role="note"><span>Note:</span> This property has no effect if <var>hasUserVerification</var> is set to <code>false</code>.</p>
     <dt data-md><var>extensions</var>
     <dd data-md>
-     <p>A string array containing the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier①⑨">extension identifiers</a> supported by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑨">Virtual Authenticator</a>.</p>
-     <p>A <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⓪">Virtual authenticator</a> MUST support all <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①④">authenticator extensions</a> present in its <var>extensions</var> array.
-It MUST NOT support any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑤">authenticator extension</a> not present in its <var>extensions</var> array.</p>
+     <p>A string array containing the <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②⓪">extension identifiers</a> supported by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators⑨">Virtual Authenticator</a>.</p>
+     <p>A <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⓪">Virtual authenticator</a> MUST support all <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑥">authenticator extensions</a> present in its <var>extensions</var> array.
+It MUST NOT support any <a data-link-type="dfn" href="#authenticator-extension" id="ref-for-authenticator-extension①⑦">authenticator extension</a> not present in its <var>extensions</var> array.</p>
     <dt data-md><var>uvm</var>
     <dd data-md>
      <p>A <code class="idl"><a data-link-type="idl" href="#typedefdef-uvmentries" id="ref-for-typedefdef-uvmentries①">UvmEntries</a></code> array to be set as the <a data-link-type="dfn" href="#authenticator-extension-output" id="ref-for-authenticator-extension-output①⑥">authenticator extension output</a> when processing the <a data-link-type="dfn" href="#user-verification-method" id="ref-for-user-verification-method①">User Verification Method</a> extension.</p>
@@ -6389,7 +6879,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
       <tr>
        <td><var>extensions</var>
        <td>string array
-       <td>An array containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②⓪">extension identifiers</a>
+       <td>An array containing <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②①">extension identifiers</a>
        <td>Empty array
       <tr>
        <td><var>uvm</var>
@@ -6435,7 +6925,7 @@ <h3 class="heading settled" data-level="11.3" id="sctn-automation-add-virtual-au
      <p>For each <var>extension</var> in <var>authenticator</var>.<var>extensions</var>:</p>
      <ol>
       <li data-md>
-       <p>If <var>extension</var> is not an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②①">extension identifier</a> supported by the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑥">endpoint node</a> WebAuthn WebDriver implementation,
+       <p>If <var>extension</var> is not an <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②②">extension identifier</a> supported by the <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-endpoint-node" id="ref-for-dfn-endpoint-node⑦">endpoint node</a> WebAuthn WebDriver implementation,
 return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑥">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑥">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-unsupported-operation" id="ref-for-dfn-unsupported-operation">unsupported operation</a>.</p>
      </ol>
     <li data-md>
@@ -6473,7 +6963,7 @@ <h3 class="heading settled" data-level="11.4" id="sctn-automation-remove-virtual
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success①">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential"><span class="secno">11.5. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="add-credential">Add Credential</dfn></span><a class="self-link" href="#sctn-automation-add-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④②">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential">Add Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑤">extension command</a> injects a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑧">Public Key Credential Source</a> into an existing <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators①⑦">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-addCredential">
     <table class="data">
      <thead>
@@ -6497,31 +6987,31 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <tbody>
       <tr>
        <td><var>credentialId</var>
-       <td>The <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id④">Credential ID</a> encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①①">Base64url Encoding</a>.
+       <td>The <a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">Credential ID</a> encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">Base64url Encoding</a>.
        <td>string
       <tr>
        <td><var>isResidentCredential</var>
-       <td> If set to <code>true</code>, a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑥">client-side discoverable credential</a> is created. If set to <code>false</code>, a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①④">server-side credential</a> is created instead. 
+       <td> If set to <code>true</code>, a <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑦">client-side discoverable credential</a> is created. If set to <code>false</code>, a <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①④">server-side credential</a> is created instead. 
        <td>boolean
       <tr>
        <td><var>rpId</var>
-       <td>The <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid④">Relying Party ID</a> the credential is scoped to.
+       <td>The <a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑥">Relying Party ID</a> the credential is scoped to.
        <td>string
       <tr>
        <td><var>privateKey</var>
-       <td> An asymmetric key package containing a single <a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey②">private key</a> per <a data-link-type="biblio" href="#biblio-rfc5958">[RFC5958]</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①②">Base64url Encoding</a>. 
+       <td> An asymmetric key package containing a single <a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey②">private key</a> per <a data-link-type="biblio" href="#biblio-rfc5958">[RFC5958]</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑧">Base64url Encoding</a>. 
        <td>string
       <tr>
        <td><var>userHandle</var>
-       <td> The <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle④">userHandle</a> associated to the credential encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①③">Base64url Encoding</a>. This property may not be defined. 
+       <td> The <a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑤">userHandle</a> associated to the credential encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑨">Base64url Encoding</a>. This property may not be defined. 
        <td>string
       <tr>
        <td><var>signCount</var>
-       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⑥">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④③">public key credential source</a>.
+       <td>The initial value for a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②④">signature counter</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⑨">public key credential source</a>.
        <td>number
       <tr>
        <td><var>largeBlob</var>
-       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④④">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①④">Base64url Encoding</a>.
+       <td> The <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob①">large, per-credential blob</a> associated to the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⓪">public key credential source</a>, encoded using <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②⓪">Base64url Encoding</a>.
                     This property may not be defined. 
        <td>string
     </table>
@@ -6532,7 +7022,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>If <var>parameters</var> is not a JSON <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object③">Object</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument⑦">invalid argument</a>.</p>
      <p class="note" role="note"><span>Note:</span> <var>parameters</var> is a <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters">Credential Parameters</a> object.</p>
     <li data-md>
-     <p>Let <var>credentialId</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑤">Base64url Encoding</a> on the <var>parameters</var>’ <var>credentialId</var> property.</p>
+     <p>Let <var>credentialId</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②①">Base64url Encoding</a> on the <var>parameters</var>’ <var>credentialId</var> property.</p>
     <li data-md>
      <p>If <var>credentialId</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error⑨">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code⑨">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument⑧">invalid argument</a>.</p>
     <li data-md>
@@ -6542,9 +7032,9 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
     <li data-md>
      <p>Let <var>rpId</var> be the <var>parameters</var>’ <var>rpId</var> property.</p>
     <li data-md>
-     <p>If <var>rpId</var> is not a valid <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑥">RP ID</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⓪">invalid argument</a>.</p>
+     <p>If <var>rpId</var> is not a valid <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑧">RP ID</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Let <var>privateKey</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑥">Base64url Encoding</a> on the <var>parameters</var>’ <var>privateKey</var> property.</p>
+     <p>Let <var>privateKey</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②②">Base64url Encoding</a> on the <var>parameters</var>’ <var>privateKey</var> property.</p>
     <li data-md>
      <p>If <var>privateKey</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①①">invalid argument</a>.</p>
     <li data-md>
@@ -6554,7 +7044,7 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>If the <var>parameters</var>’ <var>userHandle</var> property is defined:</p>
      <ol>
       <li data-md>
-       <p>Let <var>userHandle</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑦">Base64url Encoding</a> on the <var>parameters</var>’ <var>userHandle</var> property.</p>
+       <p>Let <var>userHandle</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②③">Base64url Encoding</a> on the <var>parameters</var>’ <var>userHandle</var> property.</p>
       <li data-md>
        <p>If <var>userHandle</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①④">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①④">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①③">invalid argument</a>.</p>
      </ol>
@@ -6574,10 +7064,10 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
     <li data-md>
      <p>If <var>isResidentCredential</var> is <code>true</code> and the <var>authenticator</var>’s <var>hasResidentKey</var> property is <code>false</code>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①⑦">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①⑦">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑥">invalid argument</a>.</p>
     <li data-md>
-     <p>If the <var>authenticator</var> supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob②">largeBlob</a> extension and the <var>parameters</var>’ <var>largeBlob</var> feature is defined:</p>
+     <p>If the <var>authenticator</var> supports the <a data-link-type="dfn" href="#largeblob" id="ref-for-largeblob③">largeBlob</a> extension and the <var>parameters</var>’ <var>largeBlob</var> feature is defined:</p>
      <ol>
       <li data-md>
-       <p>Let <var>largeBlob</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding①⑧">Base64url Encoding</a> on the <var>parameters</var>’ <var>largeBlob</var> property.</p>
+       <p>Let <var>largeBlob</var> be the result of decoding <a data-link-type="dfn" href="#base64url-encoding" id="ref-for-base64url-encoding②④">Base64url Encoding</a> on the <var>parameters</var>’ <var>largeBlob</var> property.</p>
       <li data-md>
        <p>If <var>largeBlob</var> is failure, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error①⑧">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code①⑧">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument①⑦">invalid argument</a>.</p>
      </ol>
@@ -6590,24 +7080,24 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
     <li data-md>
      <p>Let <var>credential</var> be a new <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑦">Client-side discoverable Public Key Credential Source</a> if <var>isResidentCredential</var> is <code>true</code> or a <a data-link-type="dfn" href="#server-side-public-key-credential-source" id="ref-for-server-side-public-key-credential-source②">Server-side Public Key Credential Source</a> otherwise whose items are:</p>
      <dl>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type②">type</a>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-type" id="ref-for-public-key-credential-source-type④">type</a>
       <dd data-md>
        <p><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialtype-public-key" id="ref-for-dom-publickeycredentialtype-public-key⑥">public-key</a></code></p>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑤">id</a>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-id" id="ref-for-public-key-credential-source-id⑥">id</a>
       <dd data-md>
        <p><var>credentialId</var></p>
       <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-privatekey" id="ref-for-public-key-credential-source-privatekey③">privateKey</a>
       <dd data-md>
        <p><var>privateKey</var></p>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑤">rpId</a>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-rpid" id="ref-for-public-key-credential-source-rpid⑦">rpId</a>
       <dd data-md>
        <p><var>rpId</var></p>
-      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑤">userHandle</a>
+      <dt data-md><a data-link-type="dfn" href="#public-key-credential-source-userhandle" id="ref-for-public-key-credential-source-userhandle⑥">userHandle</a>
       <dd data-md>
        <p><var>userHandle</var></p>
      </dl>
     <li data-md>
-     <p>Associate a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⑦">signature counter</a> <var>counter</var> to the <var>credential</var> with a starting value equal to the <var>parameters</var>’ <var>signCount</var> or <code>0</code> if <var>signCount</var> is <code>null</code>.</p>
+     <p>Associate a <a data-link-type="dfn" href="#signature-counter" id="ref-for-signature-counter②⑤">signature counter</a> <var>counter</var> to the <var>credential</var> with a starting value equal to the <var>parameters</var>’ <var>signCount</var> or <code>0</code> if <var>signCount</var> is <code>null</code>.</p>
     <li data-md>
      <p>If <var>largeBlob</var> is not <code>null</code>, set the <a data-link-type="dfn" href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob" id="ref-for-large-blob②">large, per-credential blob</a> associated to the <var>credential</var> to <var>largeBlob</var>.</p>
     <li data-md>
@@ -6616,8 +7106,8 @@ <h3 class="heading settled" data-level="11.5" id="sctn-automation-add-credential
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success②">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credentials"><span class="secno">11.6. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="get-credentials">Get Credentials</dfn></span><a class="self-link" href="#sctn-automation-get-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑤">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">Virtual Authenticator</a>, regardless of whether they were
-stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③①">navigator.credentials.create()</a></code>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#get-credentials" id="ref-for-get-credentials">Get Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑥">extension command</a> returns one <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters①">Credential Parameters</a> object for every <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥①">Public Key Credential Source</a> stored in a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⓪">Virtual Authenticator</a>, regardless of whether they were
+stored using <a data-link-type="dfn" href="#add-credential" id="ref-for-add-credential①">Add Credential</a> or <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create" id="ref-for-dom-credentialscontainer-create③②">navigator.credentials.create()</a></code>. It is defined as follows:</p>
    <figure class="table" id="table-getCredentials">
     <table class="data">
      <thead>
@@ -6638,13 +7128,13 @@ <h3 class="heading settled" data-level="11.6" id="sctn-automation-get-credential
     <li data-md>
      <p>Let <var>credentialsArray</var> be an empty array.</p>
     <li data-md>
-     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑥">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
+     <p>For each <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥②">Public Key Credential Source</a> <var>credential</var>, managed by the authenticator identified by <var>authenticatorId</var>,
 construct a corresponding <a data-link-type="dfn" href="#credential-parameters" id="ref-for-credential-parameters②">Credential Parameters</a> <a data-link-type="dfn" href="https://w3c.github.io/FileAPI/#blob-url-entry-object" id="ref-for-blob-url-entry-object④">Object</a> and add it to <var>credentialsArray</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success③">success</a> with data containing <var>credentialsArray</var>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credential"><span class="secno">11.7. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-credential">Remove Credential</dfn></span><a class="self-link" href="#sctn-automation-remove-credential"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑦">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-credential" id="ref-for-remove-credential">Remove Credential</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑦">extension command</a> removes a <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥③">Public Key Credential Source</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②②">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeCredential">
     <table class="data">
      <thead>
@@ -6665,14 +7155,14 @@ <h3 class="heading settled" data-level="11.7" id="sctn-automation-remove-credent
     <li data-md>
      <p>Let <var>authenticator</var> be the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②④">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
-     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑧">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
+     <p>If <var>credentialId</var> does not match any <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥④">Public Key Credential Source</a> managed by <var>authenticator</var>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②①">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②①">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②⓪">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source④⑨">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
+     <p>Remove the <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑤">Public Key Credential Source</a> identified by <var>credentialId</var> managed by <var>authenticator</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success④">success</a>.</p>
    </ol>
    <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-credentials"><span class="secno">11.8. </span><span class="content"><dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="remove-all-credentials">Remove All Credentials</dfn></span><a class="self-link" href="#sctn-automation-remove-all-credentials"></a></h3>
-   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤⓪">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
+   <p>The <a data-link-type="dfn" href="#remove-all-credentials" id="ref-for-remove-all-credentials">Remove All Credentials</a> WebDriver <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-extension-command" id="ref-for-dfn-extension-command⑧">extension command</a> removes all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑥">Public Key Credential Sources</a> stored on a <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑤">Virtual Authenticator</a>. It is defined as follows:</p>
    <figure class="table" id="table-removeAllCredentials">
     <table class="data">
      <thead>
@@ -6691,7 +7181,7 @@ <h3 class="heading settled" data-level="11.8" id="sctn-automation-remove-all-cre
      <p>If <var>authenticatorId</var> does not match any <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑥">Virtual Authenticator</a> stored in the <a data-link-type="dfn" href="#virtual-authenticator-database" id="ref-for-virtual-authenticator-database⑥">Virtual Authenticator
  Database</a>, return a <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error" id="ref-for-dfn-error②②">WebDriver error</a> with <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-error-code" id="ref-for-dfn-error-code②②">WebDriver error code</a> <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-invalid-argument" id="ref-for-dfn-invalid-argument②①">invalid argument</a>.</p>
     <li data-md>
-     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑤①">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
+     <p>Remove all <a data-link-type="dfn" href="#public-key-credential-source" id="ref-for-public-key-credential-source⑥⑦">Public Key Credential Sources</a> managed by the <a data-link-type="dfn" href="#virtual-authenticators" id="ref-for-virtual-authenticators②⑦">Virtual Authenticator</a> identified by <var>authenticatorId</var>.</p>
     <li data-md>
      <p>Return <a data-link-type="dfn" href="https://w3c.github.io/webdriver/#dfn-success" id="ref-for-dfn-success⑤">success</a>.</p>
    </ol>
@@ -6779,202 +7269,224 @@ <h3 class="heading settled" data-level="12.2" id="sctn-att-fmt-reg"><span class=
     <li data-md>
      <p>WebAuthn Attestation Statement Format Identifier: none</p>
     <li data-md>
-     <p>Description: Used to replace any authenticator-provided attestation statement when a WebAuthn Relying Party indicates it does not wish to receive attestation information.</p>
+     <p>Description: Used to replace any authenticator-provided attestation statement when a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Party</a> indicates it does not wish to receive attestation information.</p>
     <li data-md>
      <p>Specification Document: Section <a href="#sctn-none-attestation">§ 8.7 None Attestation Statement Format</a> of this specification</p>
    </ul>
    <h3 class="heading settled" data-level="12.3" id="sctn-extensions-reg-update"><span class="secno">12.3. </span><span class="content">WebAuthn Extension Identifier Registrations Updates</span><a class="self-link" href="#sctn-extensions-reg-update"></a></h3>
-   <p>This section updates the below-listed <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②②">extension identifier</a> values defined in Section <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a> in the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>, originally registered in <a data-link-type="biblio" href="#biblio-webauthn-1">[WebAuthn-1]</a>, to point to this specification.</p>
+   <p>This section updates the below-listed <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②③">extension identifier</a> values defined in Section <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a> in the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>, originally registered in <a data-link-type="biblio" href="#biblio-webauthn-1">[WebAuthn-1]</a>, to point to this specification.</p>
    <ul>
     <li data-md>
      <p>WebAuthn Extension Identifier: appid</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑥">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑥">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
+     <p>Description: This <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑨">authentication extension</a> allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Parties</a> that have previously registered a credential using the legacy
 FIDO JavaScript APIs to request an assertion.</p>
     <li data-md>
-     <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
+     <p>Specification Document: Section <a href="#sctn-appid-extension">§ 10.1.1 FIDO AppID Extension (appid)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: uvm</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension①⑨">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑦">authentication extension</a> enables use of a user verification method.
-The user verification method extension returns to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑦">WebAuthn Relying Party</a> which user verification methods (factors) were
+     <p>Description: This <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②②">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②⓪">authentication extension</a> enables use of a user verification method.
+The user verification method extension returns to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a> which user verification methods (factors) were
 used for the WebAuthn operation.</p>
     <li data-md>
-     <p>Specification Document: Section <a href="#sctn-uvm-extension">§ 10.3 User Verification Method Extension (uvm)</a> of this specification</p>
+     <p>Specification Document: Section <a href="#sctn-uvm-extension">§ 10.2.1 User Verification Method Extension (uvm)</a> of this specification</p>
    </ul>
    <h3 class="heading settled" data-level="12.4" id="sctn-extensions-reg"><span class="secno">12.4. </span><span class="content">WebAuthn Extension Identifier Registrations</span><a class="self-link" href="#sctn-extensions-reg"></a></h3>
-   <p>This section registers the below-listed <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②③">extension identifier</a> values, newly defined in Section <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>, in the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>.</p>
+   <p>This section registers the below-listed <a data-link-type="dfn" href="#extension-identifier" id="ref-for-extension-identifier②④">extension identifier</a> values, newly defined in Section <a href="#sctn-defined-extensions">§ 10 Defined Extensions</a>, in the IANA "WebAuthn Extension Identifiers" registry <a data-link-type="biblio" href="#biblio-iana-webauthn-registries">[IANA-WebAuthn-Registries]</a> established by <a data-link-type="biblio" href="#biblio-rfc8809">[RFC8809]</a>.</p>
    <ul>
     <li data-md>
      <p>WebAuthn Extension Identifier: appidExclude</p>
     <li data-md>
-     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑧">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi">[FIDOU2FJavaScriptAPI]</a>.</p>
+     <p>Description: This registration extension allows <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Parties</a> to exclude authenticators that contain specified credentials that were created with the legacy FIDO U2F JavaScript API <a data-link-type="biblio" href="#biblio-fidou2fjavascriptapi">[FIDOU2FJavaScriptAPI]</a>.</p>
     <li data-md>
-     <p>Specification Document: Section <a href="#sctn-appid-exclude-extension">§ 10.2 FIDO AppID Exclusion Extension (appidExclude)</a> of this specification <br><br></p>
+     <p>Specification Document: Section <a href="#sctn-appid-exclude-extension">§ 10.1.2 FIDO AppID Exclusion Extension (appidExclude)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: credProps</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension⑨">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②⓪">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑦">credential</a>'s properties,
-as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑦⑨">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party③⑨">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①③">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②③">registration extension</a> enables reporting of a newly-created <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a>'s properties,
+as determined by the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a>, to the calling <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑤">web application</a>.</p>
     <li data-md>
-     <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.4 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
+     <p>Specification Document: Section <a href="#sctn-authenticator-credential-properties-extension">§ 10.1.3 Credential Properties Extension (credProps)</a> of this specification <br><br></p>
     <li data-md>
      <p>WebAuthn Extension Identifier: largeBlob</p>
     <li data-md>
-     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①⓪">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②①">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension①⑧">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑧">Relying Party</a> to store opaque data associated with a credential.</p>
+     <p>Description: This <a data-link-type="dfn" href="#client-extension" id="ref-for-client-extension①④">client</a> <a data-link-type="dfn" href="#registration-extension" id="ref-for-registration-extension②④">registration extension</a> and <a data-link-type="dfn" href="#authentication-extension" id="ref-for-authentication-extension②①">authentication extension</a> allows a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a> to store opaque data associated with a credential.</p>
     <li data-md>
-     <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.5 Large blob storage extension (largeBlob)</a> of this specification</p>
+     <p>Specification Document: Section <a href="#sctn-large-blob-extension">§ 10.1.5 Large blob storage extension (largeBlob)</a> of this specification</p>
    </ul>
    <h2 class="heading settled" data-level="13" id="sctn-security-considerations"><span class="secno">13. </span><span class="content">Security Considerations</span><a class="self-link" href="#sctn-security-considerations"></a></h2>
    <p>This specification defines a <a href="#sctn-api">Web API</a> and a cryptographic peer-entity authentication protocol.
-The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑧">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①④">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①①">ceremonies</a>.
-The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⓪">WebAuthn Relying Party</a>'s
-computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑦⑨">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
-In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑤">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⓪">Relying Parties</a>.
-Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑥">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧①">Relying Parties</a> as to their provenance.</p>
+The <a data-link-type="dfn" href="#web-authentication-api" id="ref-for-web-authentication-api①⑤">Web Authentication API</a> allows Web developers (i.e., "authors") to utilize the Web Authentication protocol in their <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑤">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremonies</a>.
+The entities comprising the Web Authentication protocol endpoints are user-controlled <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑦">WebAuthn Authenticators</a> and a <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Party</a>'s
+computing environment hosting the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a>'s <a data-link-type="dfn" href="#web-application" id="ref-for-web-application⑥">web application</a>.
+In this model, the user agent, together with the <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑦">WebAuthn Client</a>, comprise an intermediary between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticators</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Parties</a>.
+Additionally, <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticators</a> can <a data-link-type="dfn" href="#attestation" id="ref-for-attestation②⓪">attest</a> to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Parties</a> as to their provenance.</p>
    <p>At this time, this specification does not feature detailed security considerations. However, the <a data-link-type="biblio" href="#biblio-fidosecref">[FIDOSecRef]</a> document provides a security analysis which is overall applicable to this specification.
-Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑦">authenticator</a> security characteristics.</p>
+Also, the <a data-link-type="biblio" href="#biblio-fidoauthnrsecreqs">[FIDOAuthnrSecReqs]</a> document suite provides useful information about <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> security characteristics.</p>
    <p>The below subsections comprise the current Web Authentication-specific security considerations.
 They are divided by audience;
 general security considerations are direct subsections of this section,
-while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑧">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧⓪">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧②">Relying Party</a> implementers
+while security considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="13.1" id="sctn-credentialIdSecurity"><span class="secno">13.1. </span><span class="content">Credential ID Unsigned</span><a class="self-link" href="#sctn-credentialIdSecurity"></a></h3>
-   <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑥">credential ID</a> is not signed.
-This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②②⑨">authenticator</a> returns
-the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑦">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑧">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④①">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑧">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑤">assertion</a>), and thus the interaction would end in an error.</p>
+   <p>The <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">credential ID</a> is not signed.
+This is not a problem because all that would happen if an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticator</a> returns
+the wrong <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential ID</a>, or if an attacker intercepts and manipulates the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential ID</a>, is that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Party</a> would not look up the correct <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑤">credential public key</a> with which to verify the returned signed <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤⓪">authenticator data</a> (a.k.a., <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①②">assertion</a>), and thus the interaction would end in an error.</p>
    <h3 class="heading settled" data-level="13.2" id="sctn-client-authenticator-proximity"><span class="secno">13.2. </span><span class="content">Physical Proximity between Client and Authenticator</span><a class="self-link" href="#sctn-client-authenticator-proximity"></a></h3>
-   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧①">client</a>.
+   <p>In the WebAuthn <a data-link-type="dfn" href="#authenticator-model" id="ref-for-authenticator-model④">authenticator model</a>, it is generally assumed that <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑤">roaming authenticators</a> are physically close to, and communicate directly with, the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a>.
 This arrangement has some important advantages.</p>
-   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑧②">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⓪">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.
+   <p>The promise of physical proximity between <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> is a key strength of a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②①">something you have</a> <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②②">authentication factor</a>.
 For example, if a <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑥">roaming authenticator</a> can communicate only via USB or Bluetooth,
 the limited range of these transports ensures that any malicious actor
-must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③①">authenticator</a>.
-This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③②">authenticator</a> that can be invoked remotely —
-even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③③">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present⑥">user presence</a>,
+must physically be within that range in order to interact with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a>.
+This is not necessarily true of an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticator</a> that can be invoked remotely —
+even if the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticator</a> verifies <a data-link-type="dfn" href="#concept-user-present" id="ref-for-concept-user-present④">user presence</a>,
 users can be tricked into authorizing remotely initiated malicious requests.</p>
-   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑧③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③④">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client⑧④">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑧">credentials</a>.
-By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑤">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑤">authenticator</a> is mediated by some third party,
-then the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑥">client</a> has to trust the third party to
-enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑥">authenticator</a>.
+   <p>Direct communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticator</a> means the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> can enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⓪">scope</a> restrictions for <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②②">credentials</a>.
+By contrast, if the communication between <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticator</a> is mediated by some third party,
+then the <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> has to trust the third party to
+enforce the <a data-link-type="dfn" href="#scope" id="ref-for-scope②①">scope</a> restrictions and control access to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>.
 Failure to do either could result in
-a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧③">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧④">Relying Parties</a>,
+a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> receiving <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①④">authentication assertions</a> valid for other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Parties</a>,
 or in a malicious user gaining access to <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑤">authentication assertions</a> for other users.</p>
-   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑦">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑦">client</a>,
-or where <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑧">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑧">authenticator</a> do not communicate directly,
+   <p>If designing a solution where the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a> does not need to be physically close to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a>,
+or where <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> and <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a> do not communicate directly,
 designers SHOULD consider how this affects the enforcement of <a data-link-type="dfn" href="#scope" id="ref-for-scope②②">scope</a> restrictions
-and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②③⑨">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">something you have</a> authentication factor.</p>
-   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⓪">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
+and the strength of the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> as a <a data-link-type="dfn" href="https://pages.nist.gov/800-63-3/sp800-63-3.html#af" id="ref-for-af②③">something you have</a> authentication factor.</p>
+   <h3 class="heading settled" data-level="13.3" id="sctn-security-considerations-authenticator"><span class="secno">13.3. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticators</a> <span id="sctn-attestation-security-considerations"></span></span><a class="self-link" href="#sctn-security-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="13.3.1" id="sctn-cert-hierarchy"><span class="secno">13.3.1. </span><span class="content">Attestation Certificate Hierarchy</span><a class="self-link" href="#sctn-cert-hierarchy"></a></h4>
    <p>A 3-tier hierarchy for attestation certificates is RECOMMENDED (i.e., Attestation Root, Attestation Issuing CA, Attestation
 Certificate). It is also RECOMMENDED that for each <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑧">WebAuthn Authenticator</a> device line (i.e., model), a separate issuing CA is
 used to help facilitate isolating problems with a specific version of an authenticator model.</p>
    <p>If the attestation root certificate is not dedicated to a single <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator⑨">WebAuthn Authenticator</a> device line (i.e., AAGUID), the AAGUID
-SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data④⑨">authenticator data</a>.</p>
+SHOULD be specified in the attestation certificate itself, so that it can be verified against the <a data-link-type="dfn" href="#authenticator-data" id="ref-for-authenticator-data⑤①">authenticator data</a>.</p>
    <h4 class="heading settled" data-level="13.3.2" id="sctn-ca-compromise"><span class="secno">13.3.2. </span><span class="content">Attestation Certificate and Attestation Certificate CA Compromise</span><a class="self-link" href="#sctn-ca-compromise"></a></h4>
    <p>When an intermediate CA or a root CA used for issuing attestation certificates is compromised, <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⓪">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑥">attestation key pairs</a> are still safe although their certificates can no longer be trusted. A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①①">WebAuthn Authenticator</a> manufacturer that
-has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④①">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
-intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④②">WebAuthn Relying Parties</a> MUST update their trusted root certificates
+has recorded the <a data-link-type="dfn" href="#attestation-public-key" id="ref-for-attestation-public-key①">attestation public keys</a> for their <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> models can issue new <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate⑨">attestation certificates</a> for these keys from a new
+intermediate CA or from a new root CA. If the root CA changes, the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Parties</a> MUST update their trusted root certificates
 accordingly.</p>
    <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①②">WebAuthn Authenticator</a> <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⓪">attestation certificate</a> MUST be revoked by the issuing CA if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key④">private key</a> has been compromised. A WebAuthn
 Authenticator manufacturer may need to ship a firmware update and inject new <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑤">attestation private keys</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①①">certificates</a> into already
 manufactured <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①③">WebAuthn Authenticators</a>, if the exposure was due to a firmware flaw. (The process by which this happens is out of
 scope for this specification.) If the <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①④">WebAuthn Authenticator</a> manufacturer does not have this capability, then it may not be
-possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑤">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑦">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticators</a>.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑥">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
-   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑦">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
+possible for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Parties</a> to trust any further <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statements</a> from the affected <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑤">WebAuthn Authenticators</a>.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Parties</a> in <a href="#sctn-revoked-attestation-certificates">§ 13.4.5 Revoked Attestation Certificates</a>.</p>
+   <h3 class="heading settled" data-level="13.4" id="sctn-security-considerations-rp"><span class="secno">13.4. </span><span class="content">Security considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Parties</a></span><a class="self-link" href="#sctn-security-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="13.4.1" id="sctn-rp-benefits"><span class="secno">13.4.1. </span><span class="content">Security Benefits for WebAuthn Relying Parties</span><a class="self-link" href="#sctn-rp-benefits"></a></h4>
-   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④③">WebAuthn Relying Parties</a> by this specification include:</p>
+   <p>The main benefits offered to <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Parties</a> by this specification include:</p>
    <ol>
     <li data-md>
      <p>Users and accounts can be secured using widely compatible, easy-to-use multi-factor authentication.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑧">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④②">authenticator</a> hardware to its users. Instead, each user can independently obtain
-any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④③">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④④">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑧⑨">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⓪">Relying Party</a> can optionally
-enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑤">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑧">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑥">authenticators</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Party</a> does not need to provision <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> hardware to its users. Instead, each user can independently obtain
+any conforming <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a> and use that same <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> with any number of <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Parties</a>. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a> can optionally
+enforce requirements on <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticators</a>' security properties by inspecting the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statements</a> returned from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticators</a>.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑥">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
+     <p><a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">Authentication ceremonies</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186">man-in-the-middle attacks</a>.
 Regarding <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①④">registration ceremonies</a>, see <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>, below.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨①">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑥">user verification</a> - for example PIN, biometrics and/or future
-methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑦">authenticator</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a> can automatically support multiple types of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a> - for example PIN, biometrics and/or future
+methods - with little or no code change, and can let each user decide which they prefer to use via their choice of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a>.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨②">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Party</a> does not need to store additional secrets in order to gain the above benefits.</p>
    </ol>
-   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨③">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
+   <p>As stated in the <a href="#sctn-conforming-relying-parties">Conformance</a> section, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a> MUST behave as described in <a href="#sctn-rp-operations">§ 7 WebAuthn Relying Party Operations</a> to obtain all of the above security benefits. However, one notable use case that departs slightly from this is described below in <a href="#sctn-attestation-limitations">§ 13.4.4 Attestation Limitations</a>.</p>
    <h4 class="heading settled" data-level="13.4.2" id="sctn-seccons-visibility"><span class="secno">13.4.2. </span><span class="content">Visibility Considerations for Embedded Usage</span><a class="self-link" href="#sctn-seccons-visibility"></a></h4>
-   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨④">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑤">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
-   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤①">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑥">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑦">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
+   <p>Simplistic use of WebAuthn in an embedded context, e.g., within <code><a data-link-type="element" href="https://html.spec.whatwg.org/multipage/iframe-embed-object.html#the-iframe-element" id="ref-for-the-iframe-element④">iframe</a></code>s as described in <a href="#sctn-iframe-guidance">§ 5.10 Using Web Authentication within iframe elements</a>, may make users vulnerable to <dfn class="dfn-paneled" data-dfn-type="dfn" data-noexport id="ui-redressing">UI Redressing</dfn> attacks, also known as "<a href="https://en.wikipedia.org/wiki/Clickjacking">Clickjacking</a>". This is where an attacker overlays their own UI on top of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Party</a>'s intended UI and attempts to trick the user into performing unintended actions with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Party</a>. For example, using these techniques, an attacker might be able to trick users into purchasing items, transferring money, etc.</p>
+   <p>Even though WebAuthn-specific UI is typically handled by the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platform</a> and thus is not vulnerable to <a data-link-type="dfn" href="#ui-redressing" id="ref-for-ui-redressing①">UI Redressing</a>, it is likely important for an <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Party</a> having embedded WebAuthn-wielding content to ensure that their content’s UI is visible to the user. An emerging means to do so is by observing the status of the experimental <a href="https://w3c.github.io/IntersectionObserver/v2/">Intersection Observer v2</a>'s <code>isVisible</code> attribute. For example, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a>'s script running in the embedded context could pre-emptively load itself in a popup window if it detects <code>isVisble</code> being set to <code>false</code>, thus side-stepping any occlusion of their content.</p>
    <h4 class="heading settled" data-level="13.4.3" id="sctn-cryptographic-challenges"><span class="secno">13.4.3. </span><span class="content">Cryptographic Challenges</span><a class="self-link" href="#sctn-cryptographic-challenges"></a></h4>
    <p>As a cryptographic protocol, Web Authentication is dependent upon randomized challenges
-to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions⑥">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑦">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
-by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑧">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
+to avoid replay attacks. Therefore, the values of both <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialcreationoptions" id="ref-for-dictdef-publickeycredentialcreationoptions①⓪">PublicKeyCredentialCreationOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-challenge" id="ref-for-dom-publickeycredentialcreationoptions-challenge③">challenge</a></code> and <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①③">PublicKeyCredentialRequestOptions</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-challenge" id="ref-for-dom-publickeycredentialrequestoptions-challenge④">challenge</a></code> MUST be randomly generated
+by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Parties</a> in an environment they trust (e.g., on the server-side), and the
 returned <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-challenge" id="ref-for-dom-collectedclientdata-challenge⑧">challenge</a></code> value in the client’s
 response MUST match what was generated. This SHOULD be done in a fashion that does not rely
-upon a client’s behavior, e.g., the Relying Party SHOULD store the challenge temporarily
+upon a client’s behavior, e.g., the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a> SHOULD store the challenge temporarily
 until the operation is complete. Tolerating a mismatch will compromise the security
 of the protocol.</p>
    <p>In order to prevent replay attacks, the challenges MUST contain enough entropy to make guessing them infeasible. Challenges SHOULD
 therefore be at least 16 bytes long.</p>
    <h4 class="heading settled" data-level="13.4.4" id="sctn-attestation-limitations"><span class="secno">13.4.4. </span><span class="content">Attestation Limitations</span><a class="self-link" href="#sctn-attestation-limitations"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement③⑨">attestation statement</a>, if present,
-may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④④">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑧">authenticator</a> qualities.
-For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②④⑨">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
-However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statement</a>, on its own,
-provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party②⑨⑨">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑦">attestation object</a> was generated
-by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⓪">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
-For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⓪">Relying Party</a> script.
-The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪①">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
+   <p>When <a href="#sctn-registering-a-new-credential">registering a new credential</a>, the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④⓪">attestation statement</a>, if present,
+may allow the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a> to derive assurances about various <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a> qualities.
+For example, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator</a> model, or how it stores and protects <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②②">credential private keys</a>.
+However, it is important to note that an <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a>, on its own,
+provides no means for a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> to verify that an <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑦">attestation object</a> was generated
+by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticator</a> the user intended, and not by a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186①">man-in-the-middle attacker</a>.
+For example, such an attacker could use malicious code injected into <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a> script.
+The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> must therefore rely on other means, e.g., TLS and related technologies,
 to protect the <a data-link-type="dfn" href="#attestation-object" id="ref-for-attestation-object①⑧">attestation object</a> from <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186②">man-in-the-middle attacks</a>.</p>
-   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤①">authenticator</a> maintains
-confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑦">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑦">public key
-credential</a> are resistant to <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
-   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②②">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④①">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
-same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪②">Relying Party</a> and passing through the same attacker.</p>
-   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪③">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
-than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪④">Relying Party</a>: unscathed
+   <p>Under the assumption that a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑤">registration ceremony</a> is completed securely, and that the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator</a> maintains
+confidentiality of the <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②③">credential private key</a>, subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑧">authentication ceremonies</a> using that <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key
+credential</a> are resistant to tampering by <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186③">man-in-the-middle attacks</a>.</p>
+   <p>The discussion above holds for all <a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②④">attestation types</a>. In all cases it is possible for a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186④">man-in-the-middle attacker</a> to replace the <code class="idl"><a data-link-type="idl" href="#publickeycredential" id="ref-for-publickeycredential②⑥">PublicKeyCredential</a></code> object, including the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> and the <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑥">credential public key</a> to be registered, and subsequently tamper with future <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑥">authentication assertions</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②③">scoped</a> for the
+same <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a> and passing through the same attacker.</p>
+   <p>Such an attack would potentially be detectable; since the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a> has registered the attacker’s <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑦">credential public key</a> rather
+than the user’s, the attacker must tamper with all subsequent <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremonies</a> with that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Party</a>: unscathed
 ceremonies will fail, potentially revealing the attack.</p>
-   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑧">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑤">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤②">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
-a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤③">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤④">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑥">Relying Party</a> reports
-a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑤">authenticator</a> model than the user expects.</p>
+   <p><a data-link-type="dfn" href="#attestation-type" id="ref-for-attestation-type②⑤">Attestation types</a> other than <a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation①⑨">Self Attestation</a> and <a data-link-type="dfn" href="#none" id="ref-for-none⑧">None</a> can increase the difficulty of such attacks, since <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Parties</a> can possibly display <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticator</a> information, e.g., model designation, to the user. An attacker might therefore need to use
+a genuine <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a> of the same model as the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a>, or the user might notice that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a> reports
+a different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticator</a> model than the user expects.</p>
    <p class="note" role="note"><span>Note:</span> All variants of <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑤">man-in-the-middle attacks</a> described above are more difficult for an attacker to mount
 than a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑥">man-in-the-middle attack</a> against conventional password authentication.</p>
    <h4 class="heading settled" data-level="13.4.5" id="sctn-revoked-attestation-certificates"><span class="secno">13.4.5. </span><span class="content">Revoked Attestation Certificates</span><a class="self-link" href="#sctn-revoked-attestation-certificates"></a></h4>
-   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑦">Relying Party</a>'s policy
-requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑧">Relying Party</a> also
-un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑧">public key credentials</a> that were registered
+   <p>If <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①②">attestation certificate</a> validation fails due to a revoked intermediate attestation CA certificate, and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Party</a>'s policy
+requires rejecting the registration/authentication request in these situations, then it is RECOMMENDED that the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> also
+un-registers (or marks with a trust level equivalent to "<a data-link-type="dfn" href="#self-attestation" id="ref-for-self-attestation②⓪">self attestation</a>") <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> that were registered
 after the CA compromise date using an <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①③">attestation certificate</a> chaining up to the same intermediate CA. It is thus RECOMMENDED
-that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⓪⑨">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration①⑨">registration</a> in order to un-register
-related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑤⑨">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②⓪">registration</a> was performed after revocation of such certificates.</p>
-   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑥">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
+that <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Parties</a> remember intermediate attestation CA certificates during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑥">registration</a> in order to un-register
+related <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">public key credentials</a> if the <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑦">registration</a> was performed after revocation of such certificates.</p>
+   <p>See also the related security consideration for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticators</a> in <a href="#sctn-ca-compromise">§ 13.3.2 Attestation Certificate and Attestation Certificate CA Compromise</a>.</p>
    <h4 class="heading settled" data-level="13.4.6" id="sctn-credential-loss-key-mobility"><span class="secno">13.4.6. </span><span class="content">Credential Loss and Key Mobility</span><a class="self-link" href="#sctn-credential-loss-key-mobility"></a></h4>
-   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑦">authenticators</a>.
-In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑧">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑤⑨">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⓪">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
-lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⓪">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⓪">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
-multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
+   <p>This specification defines no protocol for backing up <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②④">credential private keys</a>, or for sharing them between <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a>.
+In general, it is expected that a <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑤">credential private key</a> never leaves the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a> that created it. Losing an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">authenticator</a> therefore, in general, means losing all <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥①">credentials</a> <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑤">bound</a> to the
+lost <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">authenticator</a>, which could lock the user out of an account if the user has only one <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥②">credential</a> registered with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a>. Instead of backing up or sharing private keys, the Web Authentication API allows registering
+multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> for the same user. For example, a user might register <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential②">platform credentials</a> on
 frequently used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④④">client devices</a>, and one or more <a data-link-type="dfn" href="#roaming-credential" id="ref-for-roaming-credential①">roaming credentials</a> for use as backup and with new or rarely used <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑤">client
 devices</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①①">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥③">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③①">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①②">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
-different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥①">authenticators</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a> SHOULD allow and encourage users to register multiple <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥④">credentials</a> to the same <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user account</a>. <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Parties</a> SHOULD make use of the <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">excludeCredentials</a></code></code> and <code><code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-user" id="ref-for-dom-publickeycredentialcreationoptions-user⑦">user</a></code>.<code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id⑨">id</a></code></code> options to ensure that these
+different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">credentials</a> are <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑥">bound</a> to different <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticators</a>.</p>
    <h4 class="heading settled" data-level="13.4.7" id="sctn-unprotected-account-detection"><span class="secno">13.4.7. </span><span class="content">Unprotected account detection</span><a class="self-link" href="#sctn-unprotected-account-detection"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①③">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony②⑨">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty③">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">allowCredentials</a></code> argument as the first authentication step.
+   <p>This security consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑤">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑤">server-side credentials</a> as the first authentication step.</p>
-   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">allowCredentials</a></code> argument risks leaking information
-about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③②">user accounts</a> have WebAuthn credentials registered and which do not,
+   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code> argument risks leaking information
+about which <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user accounts</a> have WebAuthn credentials registered and which do not,
 which may be a signal of account protection strength.
-For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⓪">authentication ceremony</a> by providing only a username,
-and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①④">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③③">user accounts</a>,
-and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③④">user accounts</a>.
-The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑤">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑥">assertion</a> for successful authentication,
+For example, say an attacker can initiate an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication ceremony</a> by providing only a username,
+and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> responds with a non-empty <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> for some <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user accounts</a>,
+and with failure or a password challenge for other <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user accounts</a>.
+The attacker can then conclude that the latter <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user accounts</a> likely do not require a WebAuthn <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①③">assertion</a> for successful authentication,
 and thus focus an attack on those likely weaker accounts.</p>
    <p>This issue is similar to the one described in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>, and can be mitigated in similar ways.</p>
+   <h4 class="heading settled" data-level="13.4.8" id="sctn-code-injection"><span class="secno">13.4.8. </span><span class="content">Code injection attacks</span><a class="self-link" href="#sctn-code-injection"></a></h4>
+   <p>Any malicious code executing on an <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">origin</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scope</a> of a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Party</a>'s <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credentials</a> has the potential to invalidate any and all security guarantees WebAuthn may provide. <a data-link-type="dfn" href="#webauthn-client" id="ref-for-webauthn-client⑧">WebAuthn Clients</a> only expose the WebAuthn API in <a data-link-type="dfn" href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context" id="ref-for-secure-context①">secure contexts</a>,
+which mitigates the most basic attacks but SHOULD be combined with additional precautions by <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Parties</a>.</p>
+   <p>Code injection can happen in several ways;
+this section attempts to point out some likely scenarios and suggest suitable mitigations,
+but is not an exhaustive list.</p>
+   <ul>
+    <li data-md>
+     <p>Malicous code could be injected by a third-party script included by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a>,
+either intentionally or due to a security vulnerability in the third party.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Party</a> therefore SHOULD limit the amount of third-party script included on the <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑤">scope</a> of its <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②③">credentials</a>.</p>
+     <p>The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> SHOULD use Content Security Policy <a data-link-type="biblio" href="#biblio-csp2">[CSP2]</a>,
+and/or other appropriate technologies available at the time, to limit what script can run on its <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">origins</a>.</p>
+    <li data-md>
+     <p>Malicious code could, by the credential <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑥">scope</a> rules, be hosted on a subdomain of the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id④⑨">RP ID</a>.
+For example, user-submitted code hosted on <code>usercontent.example.org</code> could exercise any <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②④">credentials</a> <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑦">scoped</a> to the <a data-link-type="dfn" href="#rp-id" id="ref-for-rp-id⑤⓪">RP ID</a> <code>example.org</code>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a> allows a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin⑨">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>,
+malicious users could use this to launch a <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-186" id="ref-for-page-186⑦">man-in-the-middle attack</a> to obtain valid <a data-link-type="dfn" href="#authentication-assertion" id="ref-for-authentication-assertion①⑦">authentication assertions</a> and impersonate the victims of the attack.</p>
+     <p>Therefore, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> by default SHOULD NOT allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①⓪">origin</a></code> when <a href="#rp-op-verifying-assertion-step-origin">verifying the assertion</a>.
+If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> needs to allow a subdomain <code class="idl"><a data-link-type="idl" href="#dom-collectedclientdata-origin" id="ref-for-dom-collectedclientdata-origin①①">origin</a></code>,
+then the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> MUST NOT serve untrusted code on any allowed subdomain of <a data-link-type="dfn" href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised" id="ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">origins</a> within the <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑧">scope</a> of its <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credentials</a>.</p>
+   </ul>
    <h2 class="heading settled" data-level="14" id="sctn-privacy-considerations"><span class="secno">14. </span><span class="content">Privacy Considerations</span><a class="self-link" href="#sctn-privacy-considerations"></a></h2>
    <p>The privacy principles in <a data-link-type="biblio" href="#biblio-fido-privacy-principles">[FIDO-Privacy-Principles]</a> also apply to this specification.</p>
    <p>This section is divided by audience;
 general privacy considerations are direct subsections of this section,
-while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥②">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑧⑨">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑤">Relying Party</a> implementers
+while privacy considerations specifically for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticator</a>, <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> and <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> implementers
 are grouped into respective subsections.</p>
    <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span class="secno">14.1. </span><span class="content">De-anonymization Prevention Measures</span><a class="self-link" href="#sctn-privacy-attacks"></a></h3>
    <p><em>This section is not normative.</em></p>
@@ -6984,156 +7496,158 @@ <h3 class="heading settled" data-level="14.1" id="sctn-privacy-attacks"><span cl
 form of global identity, the following kinds of potentially correlatable identifiers are used:</p>
    <ul>
     <li data-md>
-     <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id③⑨">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
-     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑤">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
-private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⓪">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥③">authenticator</a>.</p>
+     <p>The user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑧">credential public keys</a>.</p>
+     <p>These are registered by the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> and subsequently used by the user to prove possession of the corresponding <a data-link-type="dfn" href="#credential-private-key" id="ref-for-credential-private-key②⑥">credential
+private key</a>. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticator</a>.</p>
     <li data-md>
-     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑥">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⓪">user handles</a>.</p>
-     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑦">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥④">authenticator</a>.</p>
+     <p>The user’s identities specific to each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a>, e.g., usernames and <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handles</a>.</p>
+     <p>These identities are obviously used by each <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> to identify a user in their system. They are also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a>.</p>
     <li data-md>
      <p>The user’s biometric characteristic(s), e.g., fingerprints or facial recognition data <a data-link-type="biblio" href="#biblio-isobiometricvocabulary">[ISOBiometricVocabulary]</a>.</p>
-     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑤">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑦">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑧">Relying Party</a>, but in
-the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨②">client</a> depending on the implementation.</p>
+     <p>This is optionally used by the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticator</a> to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a>. It is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Party</a>, but in
+the case of <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⓪">platform authenticators</a>, it might be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> depending on the implementation.</p>
     <li data-md>
-     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑥">authenticators</a>, e.g., product names.</p>
-     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④②">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③①⑨">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②①">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨③">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑦">authenticator</a>.</p>
+     <p>The models of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticators</a>, e.g., product names.</p>
+     <p>This is exposed in the <a data-link-type="dfn" href="#attestation-statement" id="ref-for-attestation-statement④③">attestation statement</a> provided to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> during <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑧">registration</a>. It is also visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">client</a> in the communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticator</a>.</p>
     <li data-md>
-     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑧">authenticators</a>, e.g., serial numbers.</p>
-     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client⑨④">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑥⑨">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⓪">Relying Party</a>.</p>
+     <p>The identities of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticators</a>, e.g., serial numbers.</p>
+     <p>This is possibly used by the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪②">client</a> to enable communication with the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a>, but is not exposed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a>.</p>
    </ul>
-   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②①">Relying Party</a>. The following sections describe the measures taken to
-prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②②">Relying Parties</a> from using it to discover a user’s personal identity.</p>
-   <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑤">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
+   <p>Some of the above information is necessarily shared with the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a>. The following sections describe the measures taken to
+prevent malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Parties</a> from using it to discover a user’s personal identity.</p>
+   <h3 class="heading settled" data-level="14.2" id="sctn-non-correlatable-credentials"><span class="secno">14.2. </span><span class="content">Anonymous, Scoped, Non-correlatable <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">Public Key Credentials</a></span><a class="self-link" href="#sctn-non-correlatable-credentials"></a></h3>
    <p><em>This section is not normative.</em></p>
-   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⓪">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑥">WebAuthn Relying Party</a> to enable strong
-authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②③">Relying Parties</a>.</p>
+   <p>Although <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key③⑨">credential public keys</a> are necessarily shared with the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to enable strong
+authentication, they are designed to be minimally identifying and not shared between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Parties</a>.</p>
    <ul>
     <li data-md>
-     <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④①">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑤">credential key pairs</a> and not users directly.</p>
+     <p><a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">Credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④⓪">credential public keys</a> are meaningless in isolation, as they only identify <a data-link-type="dfn" href="#credential-key-pair" id="ref-for-credential-key-pair⑤">credential key pairs</a> and not users directly.</p>
     <li data-md>
-     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑥">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope②④">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②④">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑤">client</a> ensures that its existence is not
-revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑤">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑥">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑥">client</a> to reveal a user’s other identities.</p>
+     <p>Each <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credential</a> is strictly <a data-link-type="dfn" href="#scope" id="ref-for-scope②⑨">scoped</a> to a specific <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a>, and the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪③">client</a> ensures that its existence is not
+revealed to other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Parties</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> thus cannot ask the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪④">client</a> to reveal a user’s other identities.</p>
     <li data-md>
-     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑦">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑦">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑦">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
-consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑧">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑧">public key credential</a> registered and available.</p>
+     <p>The <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑤">client</a> also ensures that the existence of a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">public key credential</a> is not revealed to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a> without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑥">user
+consent</a>. This is detailed further in <a href="#sctn-make-credential-privacy">§ 14.5.1 Registration Ceremony Privacy</a> and <a href="#sctn-assertion-privacy">§ 14.5.2 Authentication Ceremony Privacy</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a> thus cannot silently identify a user, even if the user has a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a> registered and available.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⓪">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④②">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑥⑨">public key credentials</a> are
-not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③②⑨">Relying Parties</a> thus cannot correlate users between their
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">Authenticators</a> ensure that the <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">credential IDs</a> and <a data-link-type="dfn" href="#credential-public-key" id="ref-for-credential-public-key④①">credential public keys</a> of different <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">public key credentials</a> are
+not correlatable as belonging to the same user. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Parties</a> thus cannot correlate users between their
 systems without additional information, e.g., a willfully reused username or e-mail address.</p>
     <li data-md>
-     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦①">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦②">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦③">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⓪">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦④">authenticators</a>.</p>
+     <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">Authenticators</a> ensure that their <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①④">attestation certificates</a> are not unique enough to identify a single <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> or a small group of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticators</a>. This is detailed further in <a href="#sctn-attestation-privacy">§ 14.4.1 Attestation Privacy</a>. A pair of malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Parties</a> thus cannot correlate users between their systems by tracking individual <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticators</a>.</p>
    </ul>
-   <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②①">user
-handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③①">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⓪">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑤">authenticate</a> the user.
-This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③②">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑥">user account</a> without a traditional username,
-further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③③">Relying Parties</a>.</p>
+   <p>Additionally, a <a data-link-type="dfn" href="#client-side-discoverable-public-key-credential-source" id="ref-for-client-side-discoverable-public-key-credential-source⑧">client-side discoverable public key credential source</a> can optionally include a <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②③">user
+handle</a> specified by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a>. The <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credential</a> can then be used to both identify and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authenticate</a> the user.
+This means that a privacy-conscious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a> can allow creation of a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④⓪">user account</a> without a traditional username,
+further improving non-correlatability between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Parties</a>.</p>
    <h3 class="heading settled" data-level="14.3" id="sctn-biometric-privacy"><span class="secno">14.3. </span><span class="content">Authenticator-local <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition④">Biometric Recognition</a></span><a class="self-link" href="#sctn-biometric-privacy"></a></h3>
-   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑤">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
-authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑧">client</a>, depending on the implementation. Biometric data is
-not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑦">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑧">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②②">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑥">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦①">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③④">Relying Party</a> therefore cannot discover the
-user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑤">Relying Party</a> cannot expose biometric data for an attacker to
-use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑥">Relying Parties</a>.</p>
-   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑦">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification④⑨">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#uv" id="ref-for-uv⑥">UV</a> <a data-link-type="dfn" href="#flags" id="ref-for-flags③④">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion⑦">assertion</a> response,
-instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑧">Relying Party</a>.</p>
-   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑥">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
+   <p><a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator①">Biometric authenticators</a> perform the <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑤">biometric recognition</a> internally in the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> - though for <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③①">platform
+authenticators</a> the biometric data might also be visible to the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑥">client</a>, depending on the implementation. Biometric data is
+not revealed to the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a>; it is used only locally to perform <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> authorizing the creation and <a data-link-type="dfn" href="#registration" id="ref-for-registration②⑨">registration</a> of, or <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> using, a <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">public key credential</a>. A malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Party</a> therefore cannot discover the
+user’s personal identity via biometric data, and a security breach at a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Party</a> cannot expose biometric data for an attacker to
+use for forging logins at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Parties</a>.</p>
+   <p>In the case where a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> requires <a data-link-type="dfn" href="#biometric-recognition" id="ref-for-biometric-recognition⑥">biometric recognition</a>, this is performed locally by the <a data-link-type="dfn" href="#biometric-authenticator" id="ref-for-biometric-authenticator②">biometric authenticator</a> perfoming <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> and then signaling the result by setting the <a data-link-type="dfn" href="#authdata-flags-uv" id="ref-for-authdata-flags-uv①⓪">UV</a> <a data-link-type="dfn" href="#authdata-flags" id="ref-for-authdata-flags④①">flag</a> in the signed <a data-link-type="dfn" href="#assertion" id="ref-for-assertion①④">assertion</a> response,
+instead of revealing the biometric data itself to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Party</a>.</p>
+   <h3 class="heading settled" data-level="14.4" id="sctn-privacy-considerations-authenticator"><span class="secno">14.4. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticators</a></span><a class="self-link" href="#sctn-privacy-considerations-authenticator"></a></h3>
    <h4 class="heading settled" data-level="14.4.1" id="sctn-attestation-privacy"><span class="secno">14.4.1. </span><span class="content">Attestation Privacy</span><a class="self-link" href="#sctn-attestation-privacy"></a></h4>
    <p><a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑤">Attestation certificates</a> and <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑦">attestation key pairs</a> can be used to track users
 or link various online identities of the same user together.
 This can be mitigated in several ways, including:</p>
    <ul>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑦">authenticators</a> in batches
-where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑧">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑥">WebAuthn Authenticator</a> manufacturer may choose to ship <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticators</a> in batches
+where <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticators</a> in a batch share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑥">attestation certificate</a> (called <a data-link-type="dfn" href="#basic-attestation" id="ref-for-basic-attestation①">Basic Attestation</a> or <a data-link-type="dfn" href="#batch-attestation" id="ref-for-batch-attestation">batch attestation</a>).
 This will anonymize the user at the risk of not being able to revoke a particular <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑦">attestation certificate</a> if its <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑥">private key</a> is compromised.
-The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑦⑨">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
+The <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticator</a> manufacturer SHOULD then ensure that such batches are large enough to provide meaningful anonymization,
 while also minimizing the batch size in order to limit the number of affected users
 in case an <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑦">attestation private key</a> is compromised.</p>
-     <p><a data-link-type="biblio" href="#biblio-uafprotocol">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⓪">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
+     <p><a data-link-type="biblio" href="#biblio-uafprotocol">[UAFProtocol]</a> requires that at least 100,000 <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> devices share the same <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑧">attestation certificate</a> in order to produce
 sufficiently large groups. This may serve as guidance about suitable batch sizes.</p>
     <li data-md>
-     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential①⑨">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧①">authenticator</a> can ship with a
+     <p>A <a data-link-type="dfn" href="#webauthn-authenticator" id="ref-for-webauthn-authenticator①⑦">WebAuthn Authenticator</a> may be capable of dynamically generating different <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑧">attestation key pairs</a> (and requesting related <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate①⑨">certificates</a>) per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑤">credential</a> as described in the <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑥">Anonymization CA</a> approach. For example, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> can ship with a
 main <a data-link-type="dfn" href="#attestation-private-key" id="ref-for-attestation-private-key⑧">attestation private key</a> (and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②⓪">certificate</a>),
 and combined with a cloud-operated <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑦">Anonymization CA</a>,
-can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⓪">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">attestation certificates</a>.</p>
+can dynamically generate per-<a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑥">credential</a> <a data-link-type="dfn" href="#attestation-key-pair" id="ref-for-attestation-key-pair⑨">attestation key pairs</a> and <a data-link-type="dfn" href="#attestation-certificate" id="ref-for-attestation-certificate②①">attestation certificates</a>.</p>
      <p class="note" role="note"><span>Note:</span> In various places outside this specification, the term "Privacy CA" is used to refer to what is termed here
     as an <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑧">Anonymization CA</a>. Because the Trusted Computing Group (TCG) also used the term "Privacy CA" to refer to what
     the TCG now refers to as an <a data-link-type="dfn" href="#attestation-ca" id="ref-for-attestation-ca③">Attestation CA</a> (ACA) <a data-link-type="biblio" href="#biblio-tcg-cmcprofile-aikcertenroll">[TCG-CMCProfile-AIKCertEnroll]</a>, we are using the term <a data-link-type="dfn" href="#anonymization-ca" id="ref-for-anonymization-ca⑨">Anonymization CA</a> here to try to mitigate
     confusion in the specific context of this specification.</p>
    </ul>
    <h4 class="heading settled" data-level="14.4.2" id="sctn-pii-privacy"><span class="secno">14.4.2. </span><span class="content">Privacy of personally identifying information Stored in Authenticators</span><a class="self-link" href="#sctn-pii-privacy"></a></h4>
-   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧②">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client⑨⑨">clients</a> outside what’s defined by this specification, e.g.,
-to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⓪">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②①">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③①">authentication
-ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧③">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⓪">user verification</a> has been
-performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧④">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤①">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑤">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified⑥">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑥">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤②">user verification</a> SHOULD NOT store personally identifying information.</p>
-   <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②②">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
-   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑦">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑧">authenticator</a>'s enrolled user(s).</p>
-   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①⓪①">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
+   <p><a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">Authenticators</a> MAY provide additional information to <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑦">clients</a> outside what’s defined by this specification, e.g.,
+to enable the <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑧">client</a> to provide a rich UI with which the user can pick which <a data-link-type="dfn" href="https://w3c.github.io/webappsec-credential-management/#concept-credential" id="ref-for-concept-credential②⑦">credential</a> to use for an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication
+ceremony</a>. If an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> chooses to do so, it SHOULD NOT expose personally identifying information unless successful <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">user verification</a> has been
+performed. If the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a> supports <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤④">user verification</a> with more than one concurrently enrolled user, the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> SHOULD NOT expose personally identifying information of users other than the currently <a data-link-type="dfn" href="#concept-user-verified" id="ref-for-concept-user-verified④">verified</a> user. Consequently, an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticator</a> that is not capable of <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑤">user verification</a> SHOULD NOT store personally identifying information.</p>
+   <p>For the purposes of this discussion, the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a> conveyed as the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialuserentity-id" id="ref-for-dom-publickeycredentialuserentity-id①⓪">id</a></code> member of <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialuserentity" id="ref-for-dictdef-publickeycredentialuserentity⑦">PublicKeyCredentialUserEntity</a></code> is not considered personally identifying information; see <a href="#sctn-user-handle-privacy">§ 14.6.1 User Handle Contents</a>.</p>
+   <p>These recommendations serve to prevent an adversary with physical access to an <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticator</a> from extracting personally identifying information about the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticator</a>'s enrolled user(s).</p>
+   <h3 class="heading settled" data-level="14.5" id="sctn-privacy-considerations-client"><span class="secno">14.5. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#client" id="ref-for-client①⓪⑨">clients</a></span><a class="self-link" href="#sctn-privacy-considerations-client"></a></h3>
    <h4 class="heading settled" data-level="14.5.1" id="sctn-make-credential-privacy"><span class="secno">14.5.1. </span><span class="content">Registration Ceremony Privacy</span><a class="self-link" href="#sctn-make-credential-privacy"></a></h4>
    <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑦">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-create-slot" id="ref-for-dom-publickeycredential-create-slot①①">[[Create]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not leak information that
-could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑧">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦②">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③③⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑧⑨">authenticator</a>:</p>
+could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤①">WebAuthn Relying Party</a> to distinguish between these cases, where "excluded" means that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credentials</a> listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">excludeCredentials</a></code> is <a data-link-type="dfn" href="#bound-credential" id="ref-for-bound-credential①⑦">bound</a> to the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⓪">authenticator</a>:</p>
    <ul>
     <li data-md>
-     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⓪">authenticators</a> are present.</p>
+     <p>No <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪①">authenticators</a> are present.</p>
     <li data-md>
-     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨①">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨②">authenticator</a> is excluded.</p>
+     <p>At least one <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪②">authenticator</a> is present, and at least one present <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪③">authenticator</a> is excluded.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⓪">Relying Party</a> could identify the user by probing for
-which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦③">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨③">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨④">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④①">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①②">ceremony</a> was canceled before the
-timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦④">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑦">Relying Party</a> could identify the user by probing for
+which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credentials</a> are available. For example, one such information leak is if the client returns a
+failure response as soon as an excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪④">authenticator</a> becomes available. In this case - especially if the excluded <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑤">authenticator</a> is a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③②">platform authenticator</a> - the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑧">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> was canceled before the
+timeout and before the user could feasibly have canceled it manually, and thus conclude that at least one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-excludecredentials" id="ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">excludeCredentials</a></code> parameter is available to the user.</p>
    <p>The above is not a concern, however, if the user has <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑧">consented</a> to create a new credential before a
 distinguishable error is returned, because in this case the user has confirmed intent to share the information that would be
 leaked.</p>
    <h4 class="heading settled" data-level="14.5.2" id="sctn-assertion-privacy"><span class="secno">14.5.2. </span><span class="content">Authentication Ceremony Privacy</span><a class="self-link" href="#sctn-assertion-privacy"></a></h4>
-   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
-leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party④⑨">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑤">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④②">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">allowCredentials</a></code>:</p>
+   <p>In order to protect users from being identified without <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent②⑨">consent</a>, implementations of the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredential-discoverfromexternalsource-slot" id="ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a></code> method need to take care to not
+leak information that could enable a malicious <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤②">WebAuthn Relying Party</a> to distinguish between these cases, where "named" means that the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credential</a> is listed by the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑨">Relying Party</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code>:</p>
    <ul>
     <li data-md>
-     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑥">credential</a> is not available.</p>
+     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credential</a> is not available.</p>
     <li data-md>
-     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑦">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
+     <p>A named <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧⓪">credential</a> is available, but the user does not <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③⓪">consent</a> to use it.</p>
    </ul>
-   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④③">Relying Party</a> could identify the user by probing
-for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑧">credentials</a> are available. For example, one such information leak is if the client returns a
-failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③②">authentication ceremony</a>. In this
-case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④④">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①③">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
-one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑦⑨">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">allowCredentials</a></code> parameter is
+   <p>If the above cases are distinguishable, information is leaked by which a malicious <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⓪">Relying Party</a> could identify the user by probing
+for which <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧①">credentials</a> are available. For example, one such information leak is if the client returns a
+failure response as soon as the user denies <a data-link-type="dfn" href="#user-consent" id="ref-for-user-consent③①">consent</a> to proceed with an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a>. In this
+case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦①">Relying Party</a> could detect that the <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> was canceled by the user and not the timeout, and thus conclude that at least
+one of the <a data-link-type="dfn" href="#public-key-credential" id="ref-for-public-key-credential⑧②">credentials</a> listed in the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> parameter is
 available to the user.</p>
    <h4 class="heading settled" data-level="14.5.3" id="sctn-os-account-privacy"><span class="secno">14.5.3. </span><span class="content">Privacy Between Operating System Accounts</span><a class="self-link" href="#sctn-os-account-privacy"></a></h4>
    <p>If a <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③③">platform authenticator</a> is included in a <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑥">client device</a> with a multi-user operating system, the <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③④">platform
 authenticator</a> and <a data-link-type="dfn" href="#client-device" id="ref-for-client-device④⑦">client device</a> SHOULD work together to ensure that the existence of any <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential③">platform credential</a> is revealed
 only to the operating system user that created that <a data-link-type="dfn" href="#platform-credential" id="ref-for-platform-credential④">platform credential</a>.</p>
-   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑤">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
+   <h3 class="heading settled" data-level="14.6" id="sctn-privacy-considerations-rp"><span class="secno">14.6. </span><span class="content">Privacy considerations for <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦②">Relying Parties</a></span><a class="self-link" href="#sctn-privacy-considerations-rp"></a></h3>
    <h4 class="heading settled" data-level="14.6.1" id="sctn-user-handle-privacy"><span class="secno">14.6.1. </span><span class="content">User Handle Contents</span><a class="self-link" href="#sctn-user-handle-privacy"></a></h4>
-   <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②③">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑥">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
-addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②④">user handle</a>. This includes hash values of personally identifying information, unless the hash
-function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑦">Relying Party</a>, since hashing does not prevent probing for guessable input
-values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑦">user account</a>.</p>
+   <p>Since the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑤">user handle</a> is not considered personally identifying information in <a href="#sctn-pii-privacy">§ 14.4.2 Privacy of personally identifying information Stored in Authenticators</a>,
+and since <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑥">authenticators</a> MAY reveal <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑥">user handles</a> without first performing <a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑥">user verification</a>,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦③">Relying Party</a> MUST NOT include personally identifying information, e.g., e-mail
+addresses or usernames, in the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑦">user handle</a>. This includes hash values of personally identifying information, unless the hash
+function is <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258">salted</a> with <a data-link-type="dfn" href="https://tools.ietf.org/html/rfc4949#page-258" id="ref-for-page-258①">salt</a> values private to the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦④">Relying Party</a>, since hashing does not prevent probing for guessable input
+values. It is RECOMMENDED to let the <a data-link-type="dfn" href="#user-handle" id="ref-for-user-handle②⑧">user handle</a> be 64 random bytes, and store this value in the <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④①">user account</a>.</p>
    <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><span class="secno">14.6.2. </span><span class="content">Username Enumeration</span><a class="self-link" href="#sctn-username-enumeration"></a></h4>
-   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③③">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤⓪">WebAuthn Relying Party</a> might leak sensitive
-information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑧">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
-initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑦">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①④">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③④⑨">Relying Party</a> responds with a failure, but then
-successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
-is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⓪">Relying Party</a> has thus leaked the possibly sensitive information that
-"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑧">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤①">Relying Party</a>.</p>
-   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤②">Relying Party</a> may implement to mitigate or prevent information
+   <p>While initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑥">registration</a> or <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③④">authentication ceremony</a>, there is a risk that the <a data-link-type="dfn" href="#webauthn-relying-party" id="ref-for-webauthn-relying-party⑤③">WebAuthn Relying Party</a> might leak sensitive
+information about its registered users. For example, if a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑤">Relying Party</a> uses e-mail addresses as usernames and an attacker attempts to
+initiate an <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">ceremony</a> for "alex.mueller@example.com" and the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑥">Relying Party</a> responds with a failure, but then
+successfully initiates an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremony</a> for "j.doe@example.com", then the attacker can conclude that "j.doe@example.com"
+is registered and "alex.mueller@example.com" is not. The <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑦">Relying Party</a> has thus leaked the possibly sensitive information that
+"j.doe@example.com" has a <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④②">user account</a> at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑧">Relying Party</a>.</p>
+   <p>The following is a non-normative, non-exhaustive list of measures the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑦⑨">Relying Party</a> may implement to mitigate or prevent information
 leakage due to such an attack:</p>
    <ul>
     <li data-md>
      <p>For <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑦">registration ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤③">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤④">Relying Party</a>-specific usernames to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⓪">Relying Party</a> uses <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧①">Relying Party</a>-specific usernames to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑧">registration ceremony</a>, disallow registration of usernames that are syntactically valid e-mail
 addresses.</p>
-         <p class="note" role="note"><span>Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑤">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
+         <p class="note" role="note"><span>Note:</span> The motivation for this suggestion is that in this case the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧②">Relying Party</a> probably has no choice but to fail the <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony①⑨">registration ceremony</a> if the user attempts to register a username that is already registered, and an information
 leak might therefore be unavoidable. By disallowing e-mail addresses as usernames, the impact of the leakage can be
-mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑥">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑦">Relying Parties</a>.</p>
+mitigated since it will be less likely that a user has the same username at this <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧③">Relying Party</a> as at other <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧④">Relying Parties</a>.</p>
        </ul>
       <li data-md>
-       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑧">Relying Party</a> uses e-mail addresses to identify users:</p>
+       <p>If the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑤">Relying Party</a> uses e-mail addresses to identify users:</p>
        <ul>
         <li data-md>
          <p>When initiating a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②⓪">registration ceremony</a>, interrupt the user interaction after the e-mail address is supplied and
@@ -7146,57 +7660,57 @@ <h4 class="heading settled" data-level="14.6.2" id="sctn-username-enumeration"><
        </ul>
      </ul>
     <li data-md>
-     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑤">authentication ceremonies</a>:</p>
+     <p>For <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremonies</a>:</p>
      <ul>
       <li data-md>
-       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑥">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account③⑨">user account</a> matching the provided username, continue the
-ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions⑧">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
-       <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">allowCredentials</a></code>;
+       <p>If, when initiating an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremony</a>, there is no <a data-link-type="dfn" href="#user-account" id="ref-for-user-account④③">user account</a> matching the provided username, continue the
+ceremony by invoking <code class="idl"><a data-link-type="idl" href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get" id="ref-for-dom-credentialscontainer-get③⑦">navigator.credentials.get()</a></code> using a syntactically valid <code class="idl"><a data-link-type="idl" href="#dictdef-publickeycredentialrequestoptions" id="ref-for-dictdef-publickeycredentialrequestoptions①④">PublicKeyCredentialRequestOptions</a></code> object that is populated with plausible imaginary values.</p>
+       <p>This approach could also be used to mitigate information leakage via <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code>;
 see <a href="#sctn-unprotected-account-detection">§ 13.4.7 Unprotected account detection</a> and <a href="#sctn-credential-id-privacy-leak">§ 14.6.3 Privacy leak via credential IDs</a>.</p>
-       <p class="note" role="note"><span>Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑤⑨">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
+       <p class="note" role="note"><span>Note:</span> The username may be "provided" in various <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑥">Relying Party</a>-specific fashions: login form, session cookie, etc.</p>
        <p class="note" role="note"><span>Note:</span> If returned imaginary values noticeably differ from actual ones, clever attackers may be able to discern them and
     thus be able to test for existence of actual accounts. Examples of noticeably different values include if the values
-    are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">allowCredentials</a></code> member could therefore be populated with pseudo-random values
+    are always the same for all username inputs, or are different in repeated attempts with the same username input. The <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> member could therefore be populated with pseudo-random values
     derived deterministically from the username, for example.</p>
       <li data-md>
-       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑤">authenticator</a>, make it indistinguishable whether
+       <p>When verifying an <code class="idl"><a data-link-type="idl" href="#authenticatorassertionresponse" id="ref-for-authenticatorassertionresponse⑧">AuthenticatorAssertionResponse</a></code> response from the <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑦">authenticator</a>, make it indistinguishable whether
   verification failed because the signature is invalid or because no such user or credential is registered.</p>
       <li data-md>
-       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑦">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
-before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑤">ceremony</a> as a subsequent step.
+       <p>Perform a multi-step <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremony</a>, e.g., beginning with supplying username and password or a session cookie,
+before initiating the WebAuthn <a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑦">ceremony</a> as a subsequent step.
 This moves the username enumeration problem from the WebAuthn step
 to the preceding authentication step, where it may be easier to solve.</p>
      </ul>
    </ul>
    <h4 class="heading settled" data-level="14.6.3" id="sctn-credential-id-privacy-leak"><span class="secno">14.6.3. </span><span class="content">Privacy leak via credential IDs</span><a class="self-link" href="#sctn-credential-id-privacy-leak"></a></h4>
    <p><em>This section is not normative.</em></p>
-   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⓪">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑧">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty④">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">allowCredentials</a></code> argument as the first authentication step.
+   <p>This privacy consideration applies to <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑦">Relying Parties</a> that support <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremonies</a> with a non-<a data-link-type="dfn" href="https://infra.spec.whatwg.org/#list-empty" id="ref-for-list-empty⑥">empty</a> <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> argument as the first authentication step.
 For example, if using authentication with <a data-link-type="dfn" href="#server-side-credential" id="ref-for-server-side-credential①⑥">server-side credentials</a> as the first authentication step.</p>
-   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">allowCredentials</a></code> argument risks leaking personally identifying information,
-since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④③">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④④">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥①">Relying Parties</a>,
-but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑤">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑥">authenticator</a> created it.
-It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑦">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥②">Relying Parties</a>,
-so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑥">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">allowCredentials</a></code> and their lengths
+   <p>In this case the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> argument risks leaking personally identifying information,
+since it exposes the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a> to an unauthenticated caller. <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">Credential IDs</a> are designed to not be correlatable between <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑧">Relying Parties</a>,
+but the length of a <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤⓪">credential ID</a> might be a hint as to what type of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑧">authenticator</a> created it.
+It is likely that a user will use the same username and set of <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③⓪⑨">authenticators</a> for several <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑧⑨">Relying Parties</a>,
+so the number of <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤①">credential IDs</a> in <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> and their lengths
 might serve as a global correlation handle to de-anonymize the user.
-Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑦">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
-given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑧">authenticators</a>.</p>
-   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥③">Relying Party</a> could for example:</p>
+Knowing a user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤②">credential IDs</a> also makes it possible to confirm guesses about the user’s identity
+given only momentary physical access to one of the user’s <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①⓪">authenticators</a>.</p>
+   <p>In order to prevent such information leakage, the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨⓪">Relying Party</a> could for example:</p>
    <ul>
     <li data-md>
      <p>Perform a separate authentication step,
 such as username and password authentication or session cookie authentication,
-before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony③⑨">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑧">credential IDs</a>.</p>
+before initiating the WebAuthn <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a> and exposing the user’s <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤③">credential IDs</a>.</p>
     <li data-md>
-     <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑦">client-side discoverable credentials</a>,
-so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">allowCredentials</a></code> argument is not needed.</p>
+     <p>Use <a data-link-type="dfn" href="#client-side-discoverable-credential" id="ref-for-client-side-discoverable-credential①⑧">client-side discoverable credentials</a>,
+so the <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">allowCredentials</a></code> argument is not needed.</p>
    </ul>
    <p>If the above prevention measures are not available,
-i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">allowCredentials</a></code> needs to be exposed given only a username,
-the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥④">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id④⑨">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
+i.e., if <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-allowcredentials" id="ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">allowCredentials</a></code> needs to be exposed given only a username,
+the <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨①">Relying Party</a> could mitigate the privacy leak using the same approach of returning imaginary <a data-link-type="dfn" href="#credential-id" id="ref-for-credential-id⑤④">credential IDs</a> as discussed in <a href="#sctn-username-enumeration">§ 14.6.2 Username Enumeration</a>.</p>
    <h2 class="heading settled" data-level="15" id="sctn-accessiblility-considerations"><span class="secno">15. </span><span class="content">Accessibility Considerations</span><a class="self-link" href="#sctn-accessiblility-considerations"></a></h2>
-   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤③">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator②⑨⑨">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑧">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a>.</p>
-   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑤">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration②③">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
-   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑥">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④⓪">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤②">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑥⑥">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤③">client platform</a> MAY adjust the timeout accordingly.</p>
+   <p><a data-link-type="dfn" href="#user-verification" id="ref-for-user-verification⑤⑦">User verification</a>-capable <a data-link-type="dfn" href="#authenticator" id="ref-for-authenticator③①①">authenticators</a>, whether <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑦">roaming</a> or <a data-link-type="dfn" href="#platform-authenticators" id="ref-for-platform-authenticators③⑤">platform</a>, should offer users more than one user verification method.  For example, both fingerprint sensing and PIN entry. This allows for fallback to other user verification means if the selected one is not working for some reason. Note that in the case of <a data-link-type="dfn" href="#roaming-authenticators" id="ref-for-roaming-authenticators②⑧">roaming authenticators</a>, the authenticator and platform might work together to provide a user verification method such as PIN entry <a data-link-type="biblio" href="#biblio-fido-ctap">[FIDO-CTAP]</a>.</p>
+   <p><a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨②">Relying Parties</a>, at <a data-link-type="dfn" href="#registration" id="ref-for-registration③⓪">registration</a> time, SHOULD provide affordances for users to complete future <a data-link-type="dfn" href="#authorization-gesture" id="ref-for-authorization-gesture③⓪">authorization gestures</a> correctly. This could involve naming the authenticator, choosing a picture to associate with the device, or entering freeform text instructions (e.g., as a reminder-to-self).</p>
+   <p><a data-link-type="dfn" href="#ceremony" id="ref-for-ceremony①⑧">Ceremonies</a> relying on timing, e.g., a <a data-link-type="dfn" href="#registration-ceremony" id="ref-for-registration-ceremony②①">registration ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialcreationoptions-timeout" id="ref-for-dom-publickeycredentialcreationoptions-timeout④">timeout</a></code>) or an <a data-link-type="dfn" href="#authentication-ceremony" id="ref-for-authentication-ceremony④①">authentication ceremony</a> (see <code class="idl"><a data-link-type="idl" href="#dom-publickeycredentialrequestoptions-timeout" id="ref-for-dom-publickeycredentialrequestoptions-timeout④">timeout</a></code>), ought to follow <a data-link-type="biblio" href="#biblio-wcag21">[WCAG21]</a>'s <a href="https://www.w3.org/TR/WCAG21/#enough-time">Guideline 2.2 Enough Time</a>. If a <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤④">client platform</a> determines that a <a data-link-type="dfn" href="#relying-party" id="ref-for-relying-party③⑨③">Relying Party</a>-supplied timeout does not appropriately adhere to the latter <a data-link-type="biblio" href="#biblio-wcag21">[WCAG21]</a> guidelines, then the <a data-link-type="dfn" href="#client-platform" id="ref-for-client-platform⑤⑤">client platform</a> MAY adjust the timeout accordingly.</p>
    <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span class="secno">16. </span><span class="content">Acknowledgements</span><a class="self-link" href="#sctn-acknowledgements"></a></h2>
     We thank the following people for their reviews of, and contributions to, this specification:
 Yuriy Ackermann,
@@ -7221,7 +7735,7 @@ <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span cla
 Johan Verrept,
 and
 Boris Zbarsky. 
-   <p>Thanks to Adam Powers for creating the overall <a data-link-type="dfn" href="#registration" id="ref-for-registration②④">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑧">authentication</a> flow diagrams
+   <p>Thanks to Adam Powers for creating the overall <a data-link-type="dfn" href="#registration" id="ref-for-registration③①">registration</a> and <a data-link-type="dfn" href="#authentication" id="ref-for-authentication①⑨">authentication</a> flow diagrams
 (<a href="#fig-registration">Figure 1</a> and <a href="#fig-authentication">Figure 2</a>).</p>
    <p>We thank
 Anthony Nadalin,
@@ -7240,40 +7754,58 @@ <h2 class="heading settled" data-level="16" id="sctn-acknowledgements"><span cla
   <h2 class="no-num no-ref heading settled" id="index"><span class="content">Index</span><a class="self-link" href="#index"></a></h2>
   <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="content">Terms defined by this specification</span><a class="self-link" href="#index-defined-here"></a></h3>
   <ul class="index">
-   <li><a href="#aaguid">aaguid</a><span>, in § 6.5.1</span>
+   <li><a href="#authdata-attestedcredentialdata-aaguid">aaguid</a><span>, in § 6.5.1</span>
    <li><a href="#add-credential">Add Credential</a><span>, in § 11.5</span>
    <li><a href="#add-virtual-authenticator">Add Virtual Authenticator</a><span>, in § 11.3</span>
    <li><a href="#dom-publickeycredentialparameters-alg">alg</a><span>, in § 5.3</span>
-   <li><a href="#dom-publickeycredentialrequestoptions-allowcredentials">allowCredentials</a><span>, in § 5.5</span>
+   <li>
+    allowCredentials
+    <ul>
+     <li><a href="#dom-publickeycredentialrequestoptions-allowcredentials">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-allowcredentials">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
+    </ul>
    <li><a href="#android-key-attestation-certificate-extension-data">android key attestation certificate extension data</a><span>, in § 8.4.1</span>
    <li><a href="#anonca">AnonCA</a><span>, in § 6.5.3</span>
    <li><a href="#anonymization-ca">Anonymization CA</a><span>, in § 6.5.3</span>
-   <li><a href="#appid">AppID</a><span>, in § 10.1</span>
+   <li><a href="#appid">AppID</a><span>, in § 10.1.1</span>
    <li>
     appid
     <ul>
-     <li><a href="#dom-authenticationextensionsclientinputs-appid">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.1</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-appid">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.1</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-appid">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.1.1</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-appid">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.1.1</span>
     </ul>
    <li>
     appidExclude
     <ul>
-     <li><a href="#dom-authenticationextensionsclientinputs-appidexclude">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.2</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-appidexclude">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.2</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-appidexclude">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.1.2</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-appidexclude">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.1.2</span>
     </ul>
    <li><a href="#assertion">Assertion</a><span>, in § 4</span>
    <li><a href="#assertion-signature">assertion signature</a><span>, in § 6</span>
+   <li><a href="#authdata-flags-at">AT</a><span>, in § 6.1</span>
    <li><a href="#attca">AttCA</a><span>, in § 6.5.3</span>
    <li><a href="#attestation">Attestation</a><span>, in § 4</span>
-   <li><a href="#dom-publickeycredentialcreationoptions-attestation">attestation</a><span>, in § 5.4</span>
+   <li>
+    attestation
+    <ul>
+     <li><a href="#dom-publickeycredentialcreationoptions-attestation">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-attestation">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#attestation-ca">Attestation CA</a><span>, in § 6.5.3</span>
    <li><a href="#attestation-certificate">Attestation Certificate</a><span>, in § 4</span>
+   <li><a href="#credential-record-attestationclientdatajson">attestationClientDataJSON</a><span>, in § 4</span>
    <li><a href="#attestation-conveyance">Attestation Conveyance</a><span>, in § 5.4.7</span>
    <li><a href="#enumdef-attestationconveyancepreference">AttestationConveyancePreference</a><span>, in § 5.4.7</span>
    <li><a href="#credentialcreationdata-attestationconveyancepreferenceoption">attestationConveyancePreferenceOption</a><span>, in § 5.1.3</span>
    <li><a href="#attestation-key-pair">attestation key pair</a><span>, in § 4</span>
    <li><a href="#attestation-object">attestation object</a><span>, in § 6.5</span>
-   <li><a href="#dom-authenticatorattestationresponse-attestationobject">attestationObject</a><span>, in § 5.2.1</span>
+   <li>
+    attestationObject
+    <ul>
+     <li><a href="#dom-authenticatorattestationresponse-attestationobject">attribute for AuthenticatorAttestationResponse</a><span>, in § 5.2.1</span>
+     <li><a href="#credential-record-attestationobject">dfn for credential record</a><span>, in § 4</span>
+     <li><a href="#dom-authenticatorattestationresponsejson-attestationobject">dict-member for AuthenticatorAttestationResponseJSON</a><span>, in § 5.1</span>
+    </ul>
    <li><a href="#credentialcreationdata-attestationobjectresult">attestationObjectResult</a><span>, in § 5.1.3</span>
    <li><a href="#attestation-private-key">attestation private key</a><span>, in § 4</span>
    <li><a href="#attestation-public-key">attestation public key</a><span>, in § 4</span>
@@ -7284,32 +7816,46 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#attestation-trust-path">attestation trust path</a><span>, in § 6.5.2</span>
    <li><a href="#attestation-type">attestation type</a><span>, in § 6.5</span>
    <li><a href="#attested-credential-data">Attested credential data</a><span>, in § 6.5.1</span>
-   <li><a href="#attestedcredentialdata">attestedCredentialData</a><span>, in § 6.1</span>
-   <li><a href="#authdataextensions">authDataExtensions</a><span>, in § 6.1</span>
+   <li><a href="#authdata-attestedcredentialdata">attestedCredentialData</a><span>, in § 6.1</span>
    <li><a href="#authentication">Authentication</a><span>, in § 4</span>
    <li><a href="#authentication-assertion">Authentication Assertion</a><span>, in § 4</span>
    <li><a href="#authentication-ceremony">Authentication Ceremony</a><span>, in § 4</span>
    <li><a href="#authentication-extension">authentication extension</a><span>, in § 9</span>
    <li><a href="#dictdef-authenticationextensionsclientinputs">AuthenticationExtensionsClientInputs</a><span>, in § 5.7.1</span>
+   <li><a href="#dictdef-authenticationextensionsclientinputsjson">AuthenticationExtensionsClientInputsJSON</a><span>, in § 5.1.8</span>
    <li><a href="#dictdef-authenticationextensionsclientoutputs">AuthenticationExtensionsClientOutputs</a><span>, in § 5.7.2</span>
-   <li><a href="#dictdef-authenticationextensionslargeblobinputs">AuthenticationExtensionsLargeBlobInputs</a><span>, in § 10.5</span>
-   <li><a href="#dictdef-authenticationextensionslargebloboutputs">AuthenticationExtensionsLargeBlobOutputs</a><span>, in § 10.5</span>
+   <li><a href="#dictdef-authenticationextensionsclientoutputsjson">AuthenticationExtensionsClientOutputsJSON</a><span>, in § 5.1</span>
+   <li><a href="#dictdef-authenticationextensionslargeblobinputs">AuthenticationExtensionsLargeBlobInputs</a><span>, in § 10.1.5</span>
+   <li><a href="#dictdef-authenticationextensionslargebloboutputs">AuthenticationExtensionsLargeBlobOutputs</a><span>, in § 10.1.5</span>
+   <li><a href="#dictdef-authenticationextensionsprfinputs">AuthenticationExtensionsPRFInputs</a><span>, in § 10.1.4</span>
+   <li><a href="#dictdef-authenticationextensionsprfoutputs">AuthenticationExtensionsPRFOutputs</a><span>, in § 10.1.4</span>
+   <li><a href="#dictdef-authenticationextensionsprfvalues">AuthenticationExtensionsPRFValues</a><span>, in § 10.1.4</span>
    <li><a href="#authentication-factor-capability">Authentication Factor Capability</a><span>, in § 6.2.3</span>
+   <li><a href="#dictdef-authenticationresponsejson">AuthenticationResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#authenticator">Authenticator</a><span>, in § 4</span>
    <li><a href="#authenticatorassertionresponse">AuthenticatorAssertionResponse</a><span>, in § 5.2.2</span>
+   <li><a href="#dictdef-authenticatorassertionresponsejson">AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#enumdef-authenticatorattachment">AuthenticatorAttachment</a><span>, in § 5.4.5</span>
    <li>
     authenticatorAttachment
     <ul>
      <li><a href="#dom-publickeycredential-authenticatorattachment">attribute for PublicKeyCredential</a><span>, in § 5.1</span>
+     <li><a href="#dom-authenticationresponsejson-authenticatorattachment">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-authenticatorselectioncriteria-authenticatorattachment">dict-member for AuthenticatorSelectionCriteria</a><span>, in § 5.4.4</span>
+     <li><a href="#dom-registrationresponsejson-authenticatorattachment">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#authenticator-attachment-modality">Authenticator Attachment Modality</a><span>, in § 6.2.1</span>
    <li><a href="#authenticatorattestationresponse">AuthenticatorAttestationResponse</a><span>, in § 5.2.1</span>
+   <li><a href="#dictdef-authenticatorattestationresponsejson">AuthenticatorAttestationResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#authenticatorcancel">authenticatorCancel</a><span>, in § 6.3.4</span>
    <li><a href="#authenticator-configuration">Authenticator Configuration</a><span>, in § 11.3</span>
    <li><a href="#authenticator-data">authenticator data</a><span>, in § 6.1</span>
-   <li><a href="#dom-authenticatorassertionresponse-authenticatordata">authenticatorData</a><span>, in § 5.2.2</span>
+   <li>
+    authenticatorData
+    <ul>
+     <li><a href="#dom-authenticatorassertionresponse-authenticatordata">attribute for AuthenticatorAssertionResponse</a><span>, in § 5.2.2</span>
+     <li><a href="#dom-authenticatorassertionresponsejson-authenticatordata">dict-member for AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
+    </ul>
    <li><a href="#authenticator-data-claimed-to-have-been-used-for-the-attestation">authenticator data claimed to have been used for the attestation</a><span>, in § 6.5.2</span>
    <li><a href="#authenticator-data-for-the-attestation">authenticator data for the attestation</a><span>, in § 6.5.2</span>
    <li><a href="#assertioncreationdata-authenticatordataresult">authenticatorDataResult</a><span>, in § 5.1.4.1</span>
@@ -7324,27 +7870,44 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#authenticator-model">Authenticator Model</a><span>, in § 6</span>
    <li><a href="#authenticator-operations">Authenticator Operations</a><span>, in § 6.3</span>
    <li><a href="#authenticatorresponse">AuthenticatorResponse</a><span>, in § 5.2</span>
-   <li><a href="#dom-publickeycredentialcreationoptions-authenticatorselection">authenticatorSelection</a><span>, in § 5.4</span>
+   <li>
+    authenticatorSelection
+    <ul>
+     <li><a href="#dom-publickeycredentialcreationoptions-authenticatorselection">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-authenticatorselection">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#dictdef-authenticatorselectioncriteria">AuthenticatorSelectionCriteria</a><span>, in § 5.4.4</span>
    <li><a href="#authenticator-session">authenticator session</a><span>, in § 6.3</span>
    <li><a href="#enumdef-authenticatortransport">AuthenticatorTransport</a><span>, in § 5.8.4</span>
    <li><a href="#authenticator-type">authenticator type</a><span>, in § 6.2</span>
    <li><a href="#authorization-gesture">Authorization Gesture</a><span>, in § 4</span>
    <li><a href="#backed-up">Backed Up</a><span>, in § 4</span>
-   <li><a href="#backup">Backup</a><span>, in § 4</span>
    <li><a href="#backup-eligibility">Backup Eligibility</a><span>, in § 4</span>
    <li><a href="#backup-eligible">Backup Eligible</a><span>, in § 4</span>
    <li><a href="#backup-state">Backup State</a><span>, in § 4</span>
    <li><a href="#base64url-encoding">Base64url Encoding</a><span>, in § 3</span>
+   <li><a href="#typedefdef-base64urlstring">Base64URLString</a><span>, in § 5.1</span>
    <li><a href="#basic">Basic</a><span>, in § 6.5.3</span>
    <li><a href="#basic-attestation">Basic Attestation</a><span>, in § 6.5.3</span>
    <li><a href="#batch-attestation">batch attestation</a><span>, in § 6.5.3</span>
+   <li>
+    BE
+    <ul>
+     <li><a href="#authdata-flags-be">dfn for authData/flags</a><span>, in § 6.1</span>
+     <li><a href="#credential-record-be">dfn for credential record</a><span>, in § 4</span>
+    </ul>
    <li><a href="#biometric-authenticator">Biometric Authenticator</a><span>, in § 4</span>
    <li><a href="#biometric-recognition">Biometric Recognition</a><span>, in § 4</span>
    <li><a href="#dom-authenticatortransport-ble">"ble"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-ble">ble</a><span>, in § 5.8.4</span>
-   <li><a href="#dom-authenticationextensionslargebloboutputs-blob">blob</a><span>, in § 10.5</span>
+   <li><a href="#dom-authenticationextensionslargebloboutputs-blob">blob</a><span>, in § 10.1.5</span>
    <li><a href="#bound-credential">Bound credential</a><span>, in § 4</span>
+   <li>
+    BS
+    <ul>
+     <li><a href="#authdata-flags-bs">dfn for authData/flags</a><span>, in § 6.1</span>
+     <li><a href="#credential-record-bs">dfn for credential record</a><span>, in § 4</span>
+    </ul>
    <li><a href="#create-candidate-authenticator">candidate authenticator</a><span>, in § 5.1.3</span>
    <li><a href="#cbor">CBOR</a><span>, in § 3</span>
    <li><a href="#ccdtostring">CCDToString</a><span>, in § 5.8.1.1</span>
@@ -7355,11 +7918,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#dom-collectedclientdata-challenge">dict-member for CollectedClientData</a><span>, in § 5.8.1</span>
      <li><a href="#dom-publickeycredentialcreationoptions-challenge">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-challenge">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
      <li><a href="#dom-publickeycredentialrequestoptions-challenge">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-challenge">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
    <li><a href="#client">Client</a><span>, in § 4</span>
    <li><a href="#client-data">client data</a><span>, in § 5.8.1</span>
-   <li><a href="#dom-authenticatorresponse-clientdatajson">clientDataJSON</a><span>, in § 5.2</span>
+   <li>
+    clientDataJSON
+    <ul>
+     <li><a href="#dom-authenticatorresponse-clientdatajson">attribute for AuthenticatorResponse</a><span>, in § 5.2</span>
+     <li><a href="#dom-authenticatorassertionresponsejson-clientdatajson">dict-member for AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
+     <li><a href="#dom-authenticatorattestationresponsejson-clientdatajson">dict-member for AuthenticatorAttestationResponseJSON</a><span>, in § 5.1</span>
+    </ul>
    <li>
     clientDataJSONResult
     <ul>
@@ -7376,13 +7947,15 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#assertioncreationdata-clientextensionresults">dfn for assertionCreationData</a><span>, in § 5.1.4.1</span>
      <li><a href="#credentialcreationdata-clientextensionresults">dfn for credentialCreationData</a><span>, in § 5.1.3</span>
+     <li><a href="#dom-authenticationresponsejson-clientextensionresults">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
+     <li><a href="#dom-registrationresponsejson-clientextensionresults">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#dom-publickeycredential-clientextensionsresults-slot">[[clientExtensionsResults]]</a><span>, in § 5.1</span>
    <li><a href="#client-platform">Client Platform</a><span>, in § 4</span>
    <li><a href="#client-side">Client-Side</a><span>, in § 4</span>
    <li><a href="#client-side-credential-storage-modality">client-side credential storage modality</a><span>, in § 6.2.2</span>
    <li><a href="#client-side-discoverable-credential">Client-side discoverable Credential</a><span>, in § 4</span>
-   <li><a href="#credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a><span>, in § 10.4</span>
+   <li><a href="#credentialpropertiesoutput-client-side-discoverable-credential-property">client-side discoverable credential property</a><span>, in § 10.1.3</span>
    <li><a href="#client-side-discoverable-public-key-credential-source">Client-side discoverable Public Key Credential Source</a><span>, in § 4</span>
    <li><a href="#dictdef-collectedclientdata">CollectedClientData</a><span>, in § 5.8.1</span>
    <li><a href="#dom-publickeycredential-collectfromcredentialstore-slot">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</a><span>, in § 5.1.4</span>
@@ -7391,25 +7964,27 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#typedefdef-cosealgorithmidentifier">COSEAlgorithmIdentifier</a><span>, in § 5.8.5</span>
    <li><a href="#created-on">created on</a><span>, in § 4</span>
    <li><a href="#dom-publickeycredential-create-slot">[[Create]](origin, options, sameOriginWithAncestors)</a><span>, in § 5.1.3</span>
+   <li><a href="#credential-descriptor-for-a-credential-record">credential descriptor for a credential record</a><span>, in § 4</span>
    <li><a href="#credential-id">Credential ID</a><span>, in § 4</span>
-   <li><a href="#credentialid">credentialId</a><span>, in § 6.5.1</span>
-   <li><a href="#credentialidlength">credentialIdLength</a><span>, in § 6.5.1</span>
+   <li><a href="#authdata-attestedcredentialdata-credentialid">credentialId</a><span>, in § 6.5.1</span>
+   <li><a href="#authdata-attestedcredentialdata-credentialidlength">credentialIdLength</a><span>, in § 6.5.1</span>
    <li><a href="#assertioncreationdata-credentialidresult">credentialIdResult</a><span>, in § 5.1.4.1</span>
    <li><a href="#credential-key-pair">Credential Key Pair</a><span>, in § 4</span>
    <li><a href="#credential-parameters">Credential Parameters</a><span>, in § 11.5</span>
    <li><a href="#credential-private-key">Credential Private Key</a><span>, in § 4</span>
    <li><a href="#credential-properties">Credential Properties</a><span>, in § 4</span>
-   <li><a href="#dictdef-credentialpropertiesoutput">CredentialPropertiesOutput</a><span>, in § 10.4</span>
+   <li><a href="#dictdef-credentialpropertiesoutput">CredentialPropertiesOutput</a><span>, in § 10.1.3</span>
    <li><a href="#credential-public-key">Credential Public Key</a><span>, in § 4</span>
-   <li><a href="#credentialpublickey">credentialPublicKey</a><span>, in § 6.5.1</span>
+   <li><a href="#authdata-attestedcredentialdata-credentialpublickey">credentialPublicKey</a><span>, in § 6.5.1</span>
+   <li><a href="#credential-record">Credential Record</a><span>, in § 4</span>
    <li><a href="#authenticator-credentials-map">credentials map</a><span>, in § 6</span>
    <li><a href="#credential-storage-modality">credential storage modality</a><span>, in § 6.2.2</span>
    <li>
     credProps
     <ul>
-     <li><a href="#credprops">definition of</a><span>, in § 10.4</span>
-     <li><a href="#dom-authenticationextensionsclientinputs-credprops">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.4</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-credprops">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.4</span>
+     <li><a href="#credprops">definition of</a><span>, in § 10.1.3</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-credprops">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.1.3</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-credprops">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.1.3</span>
     </ul>
    <li><a href="#dom-collectedclientdata-crossorigin">crossOrigin</a><span>, in § 5.8.1</span>
    <li><a href="#dom-authenticatorattachment-cross-platform">"cross-platform"</a><span>, in § 5.4.5</span>
@@ -7432,24 +8007,43 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     </ul>
    <li><a href="#discoverable-credential">Discoverable Credential</a><span>, in § 4</span>
    <li><a href="#discoverable-credential-capable">discoverable credential capable</a><span>, in § 6.2.2</span>
+   <li><a href="#discoverablecredentialmetadata">DiscoverableCredentialMetadata</a><span>, in § 6.3.5</span>
    <li><a href="#dom-publickeycredential-discoverfromexternalsource-slot">[[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors)</a><span>, in § 5.1.4.1</span>
    <li><a href="#dom-publickeycredential-discovery-slot">[[discovery]]</a><span>, in § 5.1</span>
-   <li><a href="#dom-publickeycredentialuserentity-displayname">displayName</a><span>, in § 5.4.3</span>
+   <li>
+    displayName
+    <ul>
+     <li><a href="#dom-publickeycredentialuserentity-displayname">dict-member for PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
+     <li><a href="#dom-publickeycredentialuserentityjson-displayname">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+    </ul>
+   <li><a href="#authdata-flags-ed">ED</a><span>, in § 6.1</span>
    <li><a href="#effective-resident-key-requirement-for-credential-creation">effective resident key requirement for credential creation</a><span>, in § 5.1.3</span>
-   <li><a href="#effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</a><span>, in § 5.1.4.1</span>
+   <li><a href="#effective-user-verification-requirement-for-assertion">effective user verification requirement for assertion</a><span>, in § 5.1.4.2</span>
    <li><a href="#effective-user-verification-requirement-for-credential-creation">effective user verification requirement for credential creation</a><span>, in § 5.1.3</span>
+   <li><a href="#dom-authenticationextensionsprfoutputs-enabled">enabled</a><span>, in § 10.1.4</span>
    <li><a href="#dom-attestationconveyancepreference-enterprise">"enterprise"</a><span>, in § 5.4.7</span>
    <li><a href="#dom-attestationconveyancepreference-enterprise">enterprise</a><span>, in § 5.4.7</span>
-   <li><a href="#dom-publickeycredentialcreationoptions-excludecredentials">excludeCredentials</a><span>, in § 5.4</span>
+   <li><a href="#dom-authenticationextensionsprfinputs-eval">eval</a><span>, in § 10.1.4</span>
+   <li><a href="#dom-authenticationextensionsprfinputs-evalbycredential">evalByCredential</a><span>, in § 10.1.4</span>
+   <li>
+    excludeCredentials
+    <ul>
+     <li><a href="#dom-publickeycredentialcreationoptions-excludecredentials">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-excludecredentials">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#extension-identifier">extension identifier</a><span>, in § 9.1</span>
    <li>
     extensions
     <ul>
+     <li><a href="#authdata-extensions">dfn for authData</a><span>, in § 6.1</span>
      <li><a href="#dom-publickeycredentialcreationoptions-extensions">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-extensions">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
      <li><a href="#dom-publickeycredentialrequestoptions-extensions">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-extensions">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
+   <li><a href="#dom-authenticationextensionsprfvalues-first">first</a><span>, in § 10.1.4</span>
    <li><a href="#first-factor-roaming-authenticator">First-factor roaming authenticator</a><span>, in § 6.2</span>
-   <li><a href="#flags">flags</a><span>, in § 6.1</span>
+   <li><a href="#authdata-flags">flags</a><span>, in § 6.1</span>
    <li><a href="#generating-authenticator">Generating Authenticator</a><span>, in § 4</span>
    <li><a href="#dom-authenticatorattestationresponse-getauthenticatordata">getAuthenticatorData()</a><span>, in § 5.2.1</span>
    <li><a href="#dom-publickeycredential-getclientextensionresults">getClientExtensionResults()</a><span>, in § 5.1</span>
@@ -7459,13 +8053,21 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-authenticatorattestationresponse-gettransports">getTransports()</a><span>, in § 5.2.1</span>
    <li><a href="#collectedclientdata-hash-of-the-serialized-client-data">Hash of the serialized client data</a><span>, in § 5.8.1</span>
    <li><a href="#human-palatability">Human Palatability</a><span>, in § 4</span>
+   <li><a href="#dom-authenticatortransport-hybrid">"hybrid"</a><span>, in § 5.8.4</span>
+   <li><a href="#dom-authenticatortransport-hybrid">hybrid</a><span>, in § 5.8.4</span>
    <li>
     id
     <ul>
+     <li><a href="#discoverablecredentialmetadata-id">dfn for DiscoverableCredentialMetadata</a><span>, in § 6.3.5</span>
+     <li><a href="#credential-record-id">dfn for credential record</a><span>, in § 4</span>
      <li><a href="#public-key-credential-source-id">dfn for public key credential source</a><span>, in § 4</span>
+     <li><a href="#dom-authenticationresponsejson-id">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-publickeycredentialdescriptor-id">dict-member for PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
+     <li><a href="#dom-publickeycredentialdescriptorjson-id">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
      <li><a href="#dom-publickeycredentialrpentity-id">dict-member for PublicKeyCredentialRpEntity</a><span>, in § 5.4.2</span>
      <li><a href="#dom-publickeycredentialuserentity-id">dict-member for PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
+     <li><a href="#dom-publickeycredentialuserentityjson-id">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+     <li><a href="#dom-registrationresponsejson-id">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-tokenbinding-id">dict-member for TokenBinding</a><span>, in § 5.8.1</span>
     </ul>
    <li><a href="#dom-publickeycredential-identifier-slot">[[identifier]]</a><span>, in § 5.1</span>
@@ -7473,22 +8075,29 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-attestationconveyancepreference-indirect">indirect</a><span>, in § 5.4.7</span>
    <li><a href="#dom-authenticatortransport-internal">"internal"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-internal">internal</a><span>, in § 5.8.4</span>
+   <li><a href="#dom-publickeycredential-isconditionalmediationavailable">isConditionalMediationAvailable()</a><span>, in § 5.1</span>
+   <li><a href="#publickeycredential-issuing-a-credential-request-to-an-authenticator">Issuing a Credential Request to an Authenticator</a><span>, in § 5.1.4.2</span>
    <li><a href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">isUserVerifyingPlatformAuthenticatorAvailable()</a><span>, in § 5.1.7</span>
    <li><a href="#collectedclientdata-json-compatible-serialization-of-client-data">JSON-compatible serialization of client data</a><span>, in § 5.8.1</span>
    <li>
     largeBlob
     <ul>
-     <li><a href="#largeblob">definition of</a><span>, in § 10.5</span>
-     <li><a href="#dom-authenticationextensionsclientinputs-largeblob">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.5</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-largeblob">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.5</span>
+     <li><a href="#largeblob">definition of</a><span>, in § 10.1.5</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-largeblob">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.1.5</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-largeblob">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.1.5</span>
     </ul>
-   <li><a href="#enumdef-largeblobsupport">LargeBlobSupport</a><span>, in § 10.5</span>
+   <li><a href="#enumdef-largeblobsupport">LargeBlobSupport</a><span>, in § 10.1.5</span>
    <li><a href="#credential-id-looking-up">looking up</a><span>, in § 6.3.1</span>
    <li><a href="#public-key-credential-source-managing-authenticator">managing authenticator</a><span>, in § 4</span>
    <li><a href="#multi-device-credential">multi-device credential</a><span>, in § 4</span>
    <li><a href="#multi-factor-capable">multi-factor capable</a><span>, in § 6.2.3</span>
    <li><a href="#public-key-credential-source-mutable-item">mutable item</a><span>, in § 4</span>
-   <li><a href="#dom-publickeycredentialentity-name">name</a><span>, in § 5.4.1</span>
+   <li>
+    name
+    <ul>
+     <li><a href="#dom-publickeycredentialentity-name">dict-member for PublicKeyCredentialEntity</a><span>, in § 5.4.1</span>
+     <li><a href="#dom-publickeycredentialuserentityjson-name">dict-member for PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#dom-authenticatortransport-nfc">"nfc"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-nfc">nfc</a><span>, in § 5.8.4</span>
    <li><a href="#non-discoverable-credential">Non-Discoverable Credential</a><span>, in § 4</span>
@@ -7497,7 +8106,14 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-attestationconveyancepreference-none">none</a><span>, in § 5.4.7</span>
    <li><a href="#non-resident-credential">Non-Resident Credential</a><span>, in § 4</span>
    <li><a href="#dom-collectedclientdata-origin">origin</a><span>, in § 5.8.1</span>
-   <li><a href="#public-key-credential-source-otherui">otherUI</a><span>, in § 4</span>
+   <li>
+    otherUI
+    <ul>
+     <li><a href="#discoverablecredentialmetadata-otherui">dfn for DiscoverableCredentialMetadata</a><span>, in § 6.3.5</span>
+     <li><a href="#public-key-credential-source-otherui">dfn for public key credential source</a><span>, in § 4</span>
+    </ul>
+   <li><a href="#dom-publickeycredential-parsecreationoptionsfromjson">parseCreationOptionsFromJSON(options)</a><span>, in § 5.1.8</span>
+   <li><a href="#dom-publickeycredential-parserequestoptionsfromjson">parseRequestOptionsFromJSON(options)</a><span>, in § 5.1.9</span>
    <li><a href="#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">perform the following steps to generate an authenticator data structure</a><span>, in § 6.1</span>
    <li><a href="#dom-authenticatorattachment-platform">"platform"</a><span>, in § 5.4.5</span>
    <li><a href="#dom-authenticatorattachment-platform">platform</a><span>, in § 5.4.5</span>
@@ -7507,7 +8123,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     "preferred"
     <ul>
-     <li><a href="#dom-largeblobsupport-preferred">enum-value for LargeBlobSupport</a><span>, in § 10.5</span>
+     <li><a href="#dom-largeblobsupport-preferred">enum-value for LargeBlobSupport</a><span>, in § 10.1.5</span>
      <li><a href="#dom-residentkeyrequirement-preferred">enum-value for ResidentKeyRequirement</a><span>, in § 5.4.6</span>
      <li><a href="#dom-userverificationrequirement-preferred">enum-value for UserVerificationRequirement</a><span>, in § 5.8.6</span>
     </ul>
@@ -7520,34 +8136,59 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#dom-tokenbindingstatus-present">"present"</a><span>, in § 5.8.1</span>
    <li><a href="#dom-tokenbindingstatus-present">present</a><span>, in § 5.8.1</span>
    <li><a href="#dom-publickeycredential-preventsilentaccess-slot">[[preventSilentAccess]](credential, sameOriginWithAncestors)</a><span>, in § 5.1.6</span>
+   <li>
+    prf
+    <ul>
+     <li><a href="#prf">definition of</a><span>, in § 10.1.4</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-prf">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.1.4</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-prf">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.1.4</span>
+    </ul>
    <li><a href="#public-key-credential-source-privatekey">privateKey</a><span>, in § 4</span>
-   <li><a href="#dom-publickeycredentialcreationoptions-pubkeycredparams">pubKeyCredParams</a><span>, in § 5.4</span>
+   <li>
+    pubKeyCredParams
+    <ul>
+     <li><a href="#dom-publickeycredentialcreationoptions-pubkeycredparams">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-pubkeycredparams">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#dom-publickeycredentialtype-public-key">"public-key"</a><span>, in § 5.8.2</span>
    <li><a href="#dom-publickeycredentialtype-public-key">public-key</a><span>, in § 5.8.2</span>
    <li>
     publicKey
     <ul>
+     <li><a href="#credential-record-publickey">dfn for credential record</a><span>, in § 4</span>
      <li><a href="#dom-credentialcreationoptions-publickey">dict-member for CredentialCreationOptions</a><span>, in § 5.1.1</span>
      <li><a href="#dom-credentialrequestoptions-publickey">dict-member for CredentialRequestOptions</a><span>, in § 5.1.2</span>
     </ul>
    <li><a href="#public-key-credential">Public Key Credential</a><span>, in § 4</span>
    <li><a href="#publickeycredential">PublicKeyCredential</a><span>, in § 5.1</span>
    <li><a href="#dictdef-publickeycredentialcreationoptions">PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+   <li><a href="#dictdef-publickeycredentialcreationoptionsjson">PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
    <li><a href="#dictdef-publickeycredentialdescriptor">PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
+   <li><a href="#dictdef-publickeycredentialdescriptorjson">PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
    <li><a href="#dictdef-publickeycredentialentity">PublicKeyCredentialEntity</a><span>, in § 5.4.1</span>
+   <li><a href="#typedefdef-publickeycredentialjson">PublicKeyCredentialJSON</a><span>, in § 5.1</span>
    <li><a href="#dictdef-publickeycredentialparameters">PublicKeyCredentialParameters</a><span>, in § 5.3</span>
    <li><a href="#dictdef-publickeycredentialrequestoptions">PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+   <li><a href="#dictdef-publickeycredentialrequestoptionsjson">PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
    <li><a href="#dictdef-publickeycredentialrpentity">PublicKeyCredentialRpEntity</a><span>, in § 5.4.2</span>
    <li><a href="#publickey-credentials-get-feature">publickey-credentials-get-feature</a><span>, in § 5.9</span>
    <li><a href="#public-key-credential-source">Public Key Credential Source</a><span>, in § 4</span>
    <li><a href="#enumdef-publickeycredentialtype">PublicKeyCredentialType</a><span>, in § 5.8.2</span>
    <li><a href="#dictdef-publickeycredentialuserentity">PublicKeyCredentialUserEntity</a><span>, in § 5.4.3</span>
+   <li><a href="#dictdef-publickeycredentialuserentityjson">PublicKeyCredentialUserEntityJSON</a><span>, in § 5.1.8</span>
    <li><a href="#rate-limiting">Rate Limiting</a><span>, in § 4</span>
-   <li><a href="#dom-publickeycredential-rawid">rawId</a><span>, in § 5.1</span>
-   <li><a href="#dom-authenticationextensionslargeblobinputs-read">read</a><span>, in § 10.5</span>
+   <li>
+    rawId
+    <ul>
+     <li><a href="#dom-publickeycredential-rawid">attribute for PublicKeyCredential</a><span>, in § 5.1</span>
+     <li><a href="#dom-authenticationresponsejson-rawid">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
+     <li><a href="#dom-registrationresponsejson-rawid">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
+    </ul>
+   <li><a href="#dom-authenticationextensionslargeblobinputs-read">read</a><span>, in § 10.1.5</span>
    <li><a href="#registration">Registration</a><span>, in § 4</span>
    <li><a href="#registration-ceremony">Registration Ceremony</a><span>, in § 4</span>
    <li><a href="#registration-extension">registration extension</a><span>, in § 9</span>
+   <li><a href="#dictdef-registrationresponsejson">RegistrationResponseJSON</a><span>, in § 5.1</span>
    <li><a href="#relying-party">Relying Party</a><span>, in § 4</span>
    <li><a href="#relying-party-identifier">Relying Party Identifier</a><span>, in § 4</span>
    <li><a href="#remove-all-credentials">Remove All Credentials</a><span>, in § 11.8</span>
@@ -7556,7 +8197,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li>
     "required"
     <ul>
-     <li><a href="#dom-largeblobsupport-required">enum-value for LargeBlobSupport</a><span>, in § 10.5</span>
+     <li><a href="#dom-largeblobsupport-required">enum-value for LargeBlobSupport</a><span>, in § 10.1.5</span>
      <li><a href="#dom-residentkeyrequirement-required">enum-value for ResidentKeyRequirement</a><span>, in § 5.4.6</span>
      <li><a href="#dom-userverificationrequirement-required">enum-value for UserVerificationRequirement</a><span>, in § 5.8.6</span>
     </ul>
@@ -7570,22 +8211,36 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#resident-credential">Resident Credential</a><span>, in § 4</span>
    <li><a href="#resident-key">Resident Key</a><span>, in § 4</span>
    <li><a href="#dom-authenticatorselectioncriteria-residentkey">residentKey</a><span>, in § 5.4.4</span>
-   <li><a href="#credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a><span>, in § 10.4</span>
+   <li><a href="#credentialpropertiesoutput-resident-key-credential-property">resident key credential property</a><span>, in § 10.1.3</span>
    <li><a href="#enumdef-residentkeyrequirement">ResidentKeyRequirement</a><span>, in § 5.4.6</span>
-   <li><a href="#dom-publickeycredential-response">response</a><span>, in § 5.1</span>
-   <li><a href="#dom-credentialpropertiesoutput-rk">rk</a><span>, in § 10.4</span>
+   <li>
+    response
+    <ul>
+     <li><a href="#dom-publickeycredential-response">attribute for PublicKeyCredential</a><span>, in § 5.1</span>
+     <li><a href="#dom-authenticationresponsejson-response">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
+     <li><a href="#dom-registrationresponsejson-response">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
+    </ul>
+   <li><a href="#dom-authenticationextensionsprfoutputs-results">results</a><span>, in § 10.1.4</span>
+   <li><a href="#dom-credentialpropertiesoutput-rk">rk</a><span>, in § 10.1.3</span>
    <li><a href="#roaming-authenticators">roaming authenticators</a><span>, in § 6.2.1</span>
    <li><a href="#roaming-credential">roaming credential</a><span>, in § 6.2.1</span>
-   <li><a href="#dom-publickeycredentialcreationoptions-rp">rp</a><span>, in § 5.4</span>
+   <li>
+    rp
+    <ul>
+     <li><a href="#dom-publickeycredentialcreationoptions-rp">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-rp">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#rp-id">RP ID</a><span>, in § 4</span>
    <li>
     rpId
     <ul>
      <li><a href="#public-key-credential-source-rpid">dfn for public key credential source</a><span>, in § 4</span>
      <li><a href="#dom-publickeycredentialrequestoptions-rpid">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-rpid">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
-   <li><a href="#rpidhash">rpIdHash</a><span>, in § 6.1</span>
+   <li><a href="#authdata-rpidhash">rpIdHash</a><span>, in § 6.1</span>
    <li><a href="#scope">scope</a><span>, in § 4</span>
+   <li><a href="#dom-authenticationextensionsprfvalues-second">second</a><span>, in § 10.1.4</span>
    <li><a href="#second-factor-platform-authenticator">Second-factor platform authenticator</a><span>, in § 6.2</span>
    <li><a href="#second-factor-roaming-authenticator">Second-factor roaming authenticator</a><span>, in § 6.2</span>
    <li><a href="#create-selected-authenticator">selected authenticator</a><span>, in § 5.1.3</span>
@@ -7595,21 +8250,32 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#server-side-credential-storage-modality">server-side credential storage modality</a><span>, in § 6.2.2</span>
    <li><a href="#server-side-public-key-credential-source">Server-side Public Key Credential Source</a><span>, in § 4</span>
    <li><a href="#set-user-verified">Set User Verified</a><span>, in § 11.9</span>
-   <li><a href="#dom-authenticatorassertionresponse-signature">signature</a><span>, in § 5.2.2</span>
+   <li>
+    signature
+    <ul>
+     <li><a href="#dom-authenticatorassertionresponse-signature">attribute for AuthenticatorAssertionResponse</a><span>, in § 5.2.2</span>
+     <li><a href="#dom-authenticatorassertionresponsejson-signature">dict-member for AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
+    </ul>
    <li><a href="#signature-counter">Signature Counter</a><span>, in § 6.1.1</span>
    <li><a href="#assertioncreationdata-signatureresult">signatureResult</a><span>, in § 5.1.4.1</span>
-   <li><a href="#signcount">signCount</a><span>, in § 6.1</span>
+   <li>
+    signCount
+    <ul>
+     <li><a href="#authdata-signcount">dfn for authData</a><span>, in § 6.1</span>
+     <li><a href="#credential-record-signcount">dfn for credential record</a><span>, in § 4</span>
+    </ul>
    <li><a href="#signing-procedure">Signing procedure</a><span>, in § 6.5.2</span>
+   <li><a href="#silentcredentialdiscovery">silentCredentialDiscovery</a><span>, in § 6.3.5</span>
    <li><a href="#single-device-credential">single-device credential</a><span>, in § 4</span>
    <li><a href="#single-factor-capable">single-factor capable</a><span>, in § 6.2.3</span>
    <li><a href="#dom-tokenbinding-status">status</a><span>, in § 5.8.1</span>
    <li><a href="#dom-publickeycredential-store-slot">[[Store]](credential, sameOriginWithAncestors)</a><span>, in § 5.1.5</span>
-   <li><a href="#dom-authenticationextensionslargeblobinputs-support">support</a><span>, in § 10.5</span>
+   <li><a href="#dom-authenticationextensionslargeblobinputs-support">support</a><span>, in § 10.1.5</span>
    <li><a href="#dom-tokenbindingstatus-supported">"supported"</a><span>, in § 5.8.1</span>
    <li>
     supported
     <ul>
-     <li><a href="#dom-authenticationextensionslargebloboutputs-supported">dict-member for AuthenticationExtensionsLargeBlobOutputs</a><span>, in § 10.5</span>
+     <li><a href="#dom-authenticationextensionslargebloboutputs-supported">dict-member for AuthenticationExtensionsLargeBlobOutputs</a><span>, in § 10.1.5</span>
      <li><a href="#dom-tokenbindingstatus-supported">enum-value for TokenBindingStatus</a><span>, in § 5.8.1</span>
     </ul>
    <li><a href="#test-of-user-presence">Test of User Presence</a><span>, in § 4</span>
@@ -7617,27 +8283,47 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     timeout
     <ul>
      <li><a href="#dom-publickeycredentialcreationoptions-timeout">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-timeout">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
      <li><a href="#dom-publickeycredentialrequestoptions-timeout">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-timeout">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
+   <li><a href="#dom-publickeycredential-tojson">toJSON()</a><span>, in § 5.1</span>
    <li><a href="#dictdef-tokenbinding">TokenBinding</a><span>, in § 5.8.1</span>
    <li><a href="#collectedclientdata-tokenbinding">tokenBinding</a><span>, in § 5.8.1</span>
    <li><a href="#enumdef-tokenbindingstatus">TokenBindingStatus</a><span>, in § 5.8.1</span>
    <li><a href="#dom-authenticatorattestationresponse-transports-slot">[[transports]]</a><span>, in § 5.2.1</span>
-   <li><a href="#dom-publickeycredentialdescriptor-transports">transports</a><span>, in § 5.8.3</span>
+   <li>
+    transports
+    <ul>
+     <li><a href="#credential-record-transports">dfn for credential record</a><span>, in § 4</span>
+     <li><a href="#dom-authenticatorattestationresponsejson-transports">dict-member for AuthenticatorAttestationResponseJSON</a><span>, in § 5.1</span>
+     <li><a href="#dom-publickeycredentialdescriptor-transports">dict-member for PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
+     <li><a href="#dom-publickeycredentialdescriptorjson-transports">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#dom-publickeycredential-type-slot">[[type]]</a><span>, in § 5.1</span>
    <li>
     type
     <ul>
+     <li><a href="#discoverablecredentialmetadata-type">dfn for DiscoverableCredentialMetadata</a><span>, in § 6.3.5</span>
+     <li><a href="#credential-record-type">dfn for credential record</a><span>, in § 4</span>
      <li><a href="#public-key-credential-source-type">dfn for public key credential source</a><span>, in § 4</span>
+     <li><a href="#dom-authenticationresponsejson-type">dict-member for AuthenticationResponseJSON</a><span>, in § 5.1</span>
      <li><a href="#dom-collectedclientdata-type">dict-member for CollectedClientData</a><span>, in § 5.8.1</span>
      <li><a href="#dom-publickeycredentialdescriptor-type">dict-member for PublicKeyCredentialDescriptor</a><span>, in § 5.8.3</span>
+     <li><a href="#dom-publickeycredentialdescriptorjson-type">dict-member for PublicKeyCredentialDescriptorJSON</a><span>, in § 5.1.8</span>
      <li><a href="#dom-publickeycredentialparameters-type">dict-member for PublicKeyCredentialParameters</a><span>, in § 5.3</span>
+     <li><a href="#dom-registrationresponsejson-type">dict-member for RegistrationResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#ui-redressing">UI Redressing</a><span>, in § 13.4.2</span>
-   <li><a href="#up">UP</a><span>, in § 4</span>
+   <li><a href="#authdata-flags-up">UP</a><span>, in § 6.1</span>
    <li><a href="#dom-authenticatortransport-usb">"usb"</a><span>, in § 5.8.4</span>
    <li><a href="#dom-authenticatortransport-usb">usb</a><span>, in § 5.8.4</span>
-   <li><a href="#dom-publickeycredentialcreationoptions-user">user</a><span>, in § 5.4</span>
+   <li>
+    user
+    <ul>
+     <li><a href="#dom-publickeycredentialcreationoptions-user">dict-member for PublicKeyCredentialCreationOptions</a><span>, in § 5.4</span>
+     <li><a href="#dom-publickeycredentialcreationoptionsjson-user">dict-member for PublicKeyCredentialCreationOptionsJSON</a><span>, in § 5.1.8</span>
+    </ul>
    <li><a href="#user-account">User Account</a><span>, in § 4</span>
    <li><a href="#user-consent">User Consent</a><span>, in § 4</span>
    <li><a href="#user-handle">User Handle</a><span>, in § 4</span>
@@ -7646,6 +8332,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#dom-authenticatorassertionresponse-userhandle">attribute for AuthenticatorAssertionResponse</a><span>, in § 5.2.2</span>
      <li><a href="#public-key-credential-source-userhandle">dfn for public key credential source</a><span>, in § 4</span>
+     <li><a href="#dom-authenticatorassertionresponsejson-userhandle">dict-member for AuthenticatorAssertionResponseJSON</a><span>, in § 5.1</span>
     </ul>
    <li><a href="#assertioncreationdata-userhandleresult">userHandleResult</a><span>, in § 5.1.4.1</span>
    <li><a href="#concept-user-present">User Present</a><span>, in § 4</span>
@@ -7656,20 +8343,21 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <ul>
      <li><a href="#dom-authenticatorselectioncriteria-userverification">dict-member for AuthenticatorSelectionCriteria</a><span>, in § 5.4.4</span>
      <li><a href="#dom-publickeycredentialrequestoptions-userverification">dict-member for PublicKeyCredentialRequestOptions</a><span>, in § 5.5</span>
+     <li><a href="#dom-publickeycredentialrequestoptionsjson-userverification">dict-member for PublicKeyCredentialRequestOptionsJSON</a><span>, in § 5.1.9</span>
     </ul>
-   <li><a href="#user-verification-method">User Verification Method</a><span>, in § 10.3</span>
+   <li><a href="#user-verification-method">User Verification Method</a><span>, in § 10.2.1</span>
    <li><a href="#enumdef-userverificationrequirement">UserVerificationRequirement</a><span>, in § 5.8.6</span>
    <li><a href="#concept-user-verified">User Verified</a><span>, in § 4</span>
    <li><a href="#user-verifying-platform-authenticator">User-verifying platform authenticator</a><span>, in § 6.2</span>
-   <li><a href="#uv">UV</a><span>, in § 4</span>
+   <li><a href="#authdata-flags-uv">UV</a><span>, in § 6.1</span>
    <li>
     uvm
     <ul>
-     <li><a href="#dom-authenticationextensionsclientinputs-uvm">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.3</span>
-     <li><a href="#dom-authenticationextensionsclientoutputs-uvm">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.3</span>
+     <li><a href="#dom-authenticationextensionsclientinputs-uvm">dict-member for AuthenticationExtensionsClientInputs</a><span>, in § 10.2.1</span>
+     <li><a href="#dom-authenticationextensionsclientoutputs-uvm">dict-member for AuthenticationExtensionsClientOutputs</a><span>, in § 10.2.1</span>
     </ul>
-   <li><a href="#typedefdef-uvmentries">UvmEntries</a><span>, in § 10.3</span>
-   <li><a href="#typedefdef-uvmentry">UvmEntry</a><span>, in § 10.3</span>
+   <li><a href="#typedefdef-uvmentries">UvmEntries</a><span>, in § 10.2.1</span>
+   <li><a href="#typedefdef-uvmentry">UvmEntry</a><span>, in § 10.2.1</span>
    <li><a href="#verification-procedure">Verification procedure</a><span>, in § 6.5.2</span>
    <li><a href="#verification-procedure-inputs">verification procedure inputs</a><span>, in § 6.5.2</span>
    <li><a href="#virtual-authenticator-database">Virtual Authenticator Database</a><span>, in § 11.2</span>
@@ -7683,9 +8371,222 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <li><a href="#webauthn-fido2-protocol">WebAuthn/FIDO2 protocol</a><span>, in § 1.1</span>
    <li><a href="#webauthn-relying-party">WebAuthn Relying Party</a><span>, in § 4</span>
    <li><a href="#webauthn-signature">WebAuthn signature</a><span>, in § 6</span>
-   <li><a href="#dom-authenticationextensionslargeblobinputs-write">write</a><span>, in § 10.5</span>
-   <li><a href="#dom-authenticationextensionslargebloboutputs-written">written</a><span>, in § 10.5</span>
+   <li><a href="#dom-authenticationextensionslargeblobinputs-write">write</a><span>, in § 10.1.5</span>
+   <li><a href="#dom-authenticationextensionslargebloboutputs-written">written</a><span>, in § 10.1.5</span>
   </ul>
+  <aside class="dfn-panel" data-for="term-for-credential">
+   <a href="https://w3c.github.io/webappsec-credential-management/#credential">https://w3c.github.io/webappsec-credential-management/#credential</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential">3. Dependencies</a>
+    <li><a href="#ref-for-credential①">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-credential②">(2)</a> <a href="#ref-for-credential③">(3)</a> <a href="#ref-for-credential④">(4)</a> <a href="#ref-for-credential⑤">(5)</a> <a href="#ref-for-credential⑥">(6)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dictdef-credentialcreationoptions">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions">https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-credentialcreationoptions">5.1.1. CredentialCreationOptions Dictionary Extension</a> <a href="#ref-for-dictdef-credentialcreationoptions①">(2)</a>
+    <li><a href="#ref-for-dictdef-credentialcreationoptions②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dictdef-credentialrequestoptions">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions">https://w3c.github.io/webappsec-credential-management/#dictdef-credentialrequestoptions</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-credentialrequestoptions">5.1.2. CredentialRequestOptions Dictionary Extension</a> <a href="#ref-for-dictdef-credentialrequestoptions①">(2)</a>
+    <li><a href="#ref-for-dictdef-credentialrequestoptions②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-credentialscontainer">
+   <a href="https://w3c.github.io/webappsec-credential-management/#credentialscontainer">https://w3c.github.io/webappsec-credential-management/#credentialscontainer</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credentialscontainer">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-credentialscontainer①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-credentialscontainer②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-credentialscontainer③">5.9. Permissions Policy integration</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-abstract-opdef-request-a-credential">
+   <a href="https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential">https://w3c.github.io/webappsec-credential-management/#abstract-opdef-request-a-credential</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-abstract-opdef-request-a-credential">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-abstract-opdef-request-a-credential①">5.9. Permissions Policy integration</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-collectfromcredentialstore-origin-options-sameoriginwithancestors">
+   <a href="https://w3c.github.io/webappsec-credential-management/#collectfromcredentialstore-origin-options-sameoriginwithancestors">https://w3c.github.io/webappsec-credential-management/#collectfromcredentialstore-origin-options-sameoriginwithancestors</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-collectfromcredentialstore-origin-options-sameoriginwithancestors">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-collectfromcredentialstore-origin-options-sameoriginwithancestors①">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-create-origin-options-sameoriginwithancestors">
+   <a href="https://w3c.github.io/webappsec-credential-management/#create-origin-options-sameoriginwithancestors">https://w3c.github.io/webappsec-credential-management/#create-origin-options-sameoriginwithancestors</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-create-origin-options-sameoriginwithancestors">5.6. Abort Operations with AbortSignal</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-store-credential-sameoriginwithancestors">
+   <a href="https://w3c.github.io/webappsec-credential-management/#store-credential-sameoriginwithancestors">https://w3c.github.io/webappsec-credential-management/#store-credential-sameoriginwithancestors</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-store-credential-sameoriginwithancestors">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credential-discovery-slot">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot">https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-slot</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credential-discovery-slot">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credential-type-slot">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot">https://w3c.github.io/webappsec-credential-management/#dom-credential-type-slot</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credential-type-slot">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credentialmediationrequirement-conditional">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional">https://w3c.github.io/webappsec-credential-management/#dom-credentialmediationrequirement-conditional</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credentialmediationrequirement-conditional">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional①">(2)</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional②">(3)</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional③">(4)</a>
+    <li><a href="#ref-for-dom-credentialmediationrequirement-conditional④">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional⑤">(2)</a>
+    <li><a href="#ref-for-dom-credentialmediationrequirement-conditional⑥">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional⑦">(2)</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional⑧">(3)</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional⑨">(4)</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional①⓪">(5)</a> <a href="#ref-for-dom-credentialmediationrequirement-conditional①①">(6)</a>
+    <li><a href="#ref-for-dom-credentialmediationrequirement-conditional①②">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-dom-credentialmediationrequirement-conditional①③">6.3.5. The silentCredentialDiscovery operation</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credentialscontainer-create">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create">https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-create</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credentialscontainer-create">1. Introduction</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①">4. Terminology</a> <a href="#ref-for-dom-credentialscontainer-create②">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create③">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dom-credentialscontainer-create④">(2)</a> <a href="#ref-for-dom-credentialscontainer-create⑤">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create⑥">5.1.1. CredentialCreationOptions Dictionary Extension</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create⑦">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialscontainer-create⑧">(2)</a> <a href="#ref-for-dom-credentialscontainer-create⑨">(3)</a> <a href="#ref-for-dom-credentialscontainer-create①⓪">(4)</a> <a href="#ref-for-dom-credentialscontainer-create①①">(5)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①②">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①③">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①④">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dom-credentialscontainer-create①⑤">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①⑥">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-dom-credentialscontainer-create①⑦">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①⑧">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create①⑨">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-credentialscontainer-create②⓪">(2)</a> <a href="#ref-for-dom-credentialscontainer-create②①">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create②②">6.2.2. Credential Storage Modality</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create②③">6.5.3. Attestation Types</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create②④">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create②⑤">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create②⑥">9. WebAuthn Extensions</a> <a href="#ref-for-dom-credentialscontainer-create②⑦">(2)</a> <a href="#ref-for-dom-credentialscontainer-create②⑧">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create②⑨">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create③⓪">9.3. Extending Request Parameters</a> <a href="#ref-for-dom-credentialscontainer-create③①">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-create③②">11.6. Get Credentials</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-concept-credential">
+   <a href="https://w3c.github.io/webappsec-credential-management/#concept-credential">https://w3c.github.io/webappsec-credential-management/#concept-credential</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-concept-credential">4. Terminology</a> <a href="#ref-for-concept-credential①">(2)</a> <a href="#ref-for-concept-credential②">(3)</a> <a href="#ref-for-concept-credential③">(4)</a> <a href="#ref-for-concept-credential④">(5)</a> <a href="#ref-for-concept-credential⑤">(6)</a>
+    <li><a href="#ref-for-concept-credential⑥">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-concept-credential⑦">(2)</a>
+    <li><a href="#ref-for-concept-credential⑧">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-concept-credential⑨">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-concept-credential①⓪">(2)</a> <a href="#ref-for-concept-credential①①">(3)</a>
+    <li><a href="#ref-for-concept-credential①②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-concept-credential①③">6.1.3. Credential Backup State</a> <a href="#ref-for-concept-credential①④">(2)</a>
+    <li><a href="#ref-for-concept-credential①⑤">6.2.2. Credential Storage Modality</a>
+    <li><a href="#ref-for-concept-credential①⑥">6.5.3. Attestation Types</a>
+    <li><a href="#ref-for-concept-credential①⑦">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-concept-credential①⑧">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-concept-credential①⑨">(2)</a> <a href="#ref-for-concept-credential②⓪">(3)</a>
+    <li><a href="#ref-for-concept-credential②①">12.4. WebAuthn Extension Identifier Registrations</a>
+    <li><a href="#ref-for-concept-credential②②">13.2. Physical Proximity between Client and Authenticator</a>
+    <li><a href="#ref-for-concept-credential②③">13.4.8. Code injection attacks</a> <a href="#ref-for-concept-credential②④">(2)</a>
+    <li><a href="#ref-for-concept-credential②⑤">14.4.1. Attestation Privacy</a> <a href="#ref-for-concept-credential②⑥">(2)</a>
+    <li><a href="#ref-for-concept-credential②⑦">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-credential-source">
+   <a href="https://w3c.github.io/webappsec-credential-management/#credential-source">https://w3c.github.io/webappsec-credential-management/#credential-source</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-source">4. Terminology</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credentialscontainer-get">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get">https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-get</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credentialscontainer-get">1. Introduction</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get①">4. Terminology</a> <a href="#ref-for-dom-credentialscontainer-get②">(2)</a> <a href="#ref-for-dom-credentialscontainer-get③">(3)</a> <a href="#ref-for-dom-credentialscontainer-get④">(4)</a> <a href="#ref-for-dom-credentialscontainer-get⑤">(5)</a> <a href="#ref-for-dom-credentialscontainer-get⑥">(6)</a> <a href="#ref-for-dom-credentialscontainer-get⑦">(7)</a> <a href="#ref-for-dom-credentialscontainer-get⑧">(8)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get⑨">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dom-credentialscontainer-get①⓪">(2)</a> <a href="#ref-for-dom-credentialscontainer-get①①">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get①②">5.1.2. CredentialRequestOptions Dictionary Extension</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get①③">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-dom-credentialscontainer-get①④">(2)</a> <a href="#ref-for-dom-credentialscontainer-get①⑤">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get①⑥">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialscontainer-get①⑦">(2)</a> <a href="#ref-for-dom-credentialscontainer-get①⑧">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get①⑨">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②⓪">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②①">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dom-credentialscontainer-get②③">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-credentialscontainer-get②⑤">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②⑥">5.9. Permissions Policy integration</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②⑦">6.2.2. Credential Storage Modality</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②⑧">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get②⑨">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get③⓪">9. WebAuthn Extensions</a> <a href="#ref-for-dom-credentialscontainer-get③①">(2)</a> <a href="#ref-for-dom-credentialscontainer-get③②">(3)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get③③">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get③④">9.3. Extending Request Parameters</a> <a href="#ref-for-dom-credentialscontainer-get③⑤">(2)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get③⑥">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-dom-credentialscontainer-get③⑦">14.6.2. Username Enumeration</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credential-id">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credential-id">https://w3c.github.io/webappsec-credential-management/#dom-credential-id</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credential-id">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-dom-credential-id①">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dom-credential-id②">7.2. Verifying an Authentication Assertion</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credentialrequestoptions-mediation">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation">https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-mediation</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credentialrequestoptions-mediation">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-mediation①">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-mediation②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialrequestoptions-mediation③">(2)</a> <a href="#ref-for-dom-credentialrequestoptions-mediation④">(3)</a> <a href="#ref-for-dom-credentialrequestoptions-mediation⑤">(4)</a> <a href="#ref-for-dom-credentialrequestoptions-mediation⑥">(5)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credential-discovery-remote">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote">https://w3c.github.io/webappsec-credential-management/#dom-credential-discovery-remote</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credential-discovery-remote">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-same-origin-with-its-ancestors">
+   <a href="https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors">https://w3c.github.io/webappsec-credential-management/#same-origin-with-its-ancestors</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-same-origin-with-its-ancestors">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-same-origin-with-its-ancestors①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-same-origin-with-its-ancestors②">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credentialrequestoptions-signal">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal">https://w3c.github.io/webappsec-credential-management/#dom-credentialrequestoptions-signal</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credentialrequestoptions-signal">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialrequestoptions-signal①">(2)</a> <a href="#ref-for-dom-credentialrequestoptions-signal②">(3)</a> <a href="#ref-for-dom-credentialrequestoptions-signal③">(4)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credentialscontainer-store">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store">https://w3c.github.io/webappsec-credential-management/#dom-credentialscontainer-store</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credentialscontainer-store">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dom-credential-type">
+   <a href="https://w3c.github.io/webappsec-credential-management/#dom-credential-type">https://w3c.github.io/webappsec-credential-management/#dom-credential-type</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-credential-type">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-dom-credential-type①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
+    <li><a href="#ref-for-dom-credential-type②">7.1. Registering a New Credential</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-user-mediated">
+   <a href="https://w3c.github.io/webappsec-credential-management/#user-mediated">https://w3c.github.io/webappsec-credential-management/#user-mediated</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-user-mediated">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-user-mediated①">(2)</a>
+    <li><a href="#ref-for-user-mediated②">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-user-mediated③">(2)</a>
+    <li><a href="#ref-for-user-mediated④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-user-mediated⑤">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-user-mediated⑥">6.3.5. The silentCredentialDiscovery operation</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-abortcontroller">
    <a href="https://dom.spec.whatwg.org/#abortcontroller">https://dom.spec.whatwg.org/#abortcontroller</a><b>Referenced in:</b>
    <ul>
@@ -7724,7 +8625,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-concept-document">
    <a href="https://dom.spec.whatwg.org/#concept-document">https://dom.spec.whatwg.org/#concept-document</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-concept-document">5.6. Abort Operations with AbortSignal</a>
+    <li><a href="#ref-for-concept-document">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-concept-document①">5.6. Abort Operations with AbortSignal</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-sec-arraybuffer-constructor">
@@ -7794,16 +8696,16 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid">https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-if-a-caller-s-facetid-is-authorized-for-an-appid</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid">3. Dependencies</a>
-    <li><a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid①">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid②">(2)</a>
-    <li><a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">10.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">(2)</a>
+    <li><a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid①">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid②">(2)</a>
+    <li><a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid③">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-determining-if-a-caller-s-facetid-is-authorized-for-an-appid④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-determining-the-facetid-of-a-calling-application">
    <a href="https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application">https://fidoalliance.org/specs/fido-v2.0-id-20180227/fido-appid-and-facets-v2.0-id-20180227.html#determining-the-facetid-of-a-calling-application</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-determining-the-facetid-of-a-calling-application">3. Dependencies</a>
-    <li><a href="#ref-for-determining-the-facetid-of-a-calling-application①">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-determining-the-facetid-of-a-calling-application②">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-determining-the-facetid-of-a-calling-application①">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-determining-the-facetid-of-a-calling-application②">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-ctap2-canonical-cbor-encoding-form">
@@ -7818,7 +8720,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-large-blob">
    <a href="https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob">https://fidoalliance.org/specs/fido-v2.0-ps-20190130/fido-client-to-authenticator-protocol-v2.0-ps-20190130.html#large-blob</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-large-blob">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-large-blob">10.1.5. Large blob storage extension (largeBlob)</a>
     <li><a href="#ref-for-large-blob①">11.5. Add Credential</a> <a href="#ref-for-large-blob②">(2)</a>
    </ul>
   </aside>
@@ -7831,19 +8733,19 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-user-verification-methods">
    <a href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods">https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#user-verification-methods</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-user-verification-methods">10.3. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-user-verification-methods">10.2.1. User Verification Method Extension (uvm)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-key-protection-types">
    <a href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types">https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#key-protection-types</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-key-protection-types">10.3. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-key-protection-types">10.2.1. User Verification Method Extension (uvm)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-matcher-protection-types">
    <a href="https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types">https://fidoalliance.org/specs/common-specs/fido-registry-v2.1-ps-20191217.html#matcher-protection-types</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-matcher-protection-types">10.3. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-matcher-protection-types">10.2.1. User Verification Method Extension (uvm)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-public-key-representation-formats">
@@ -7899,6 +8801,18 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-ascii-serialisation-of-an-origin①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-attr-fe-autocomplete">
+   <a href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete">https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#attr-fe-autocomplete</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-attr-fe-autocomplete">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-autofill-detail-tokens">
+   <a href="https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens">https://html.spec.whatwg.org/multipage/form-control-infrastructure.html#autofill-detail-tokens</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-autofill-detail-tokens">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-autofill-detail-tokens①">(2)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-browsing-context">
    <a href="https://html.spec.whatwg.org/multipage/browsers.html#browsing-context">https://html.spec.whatwg.org/multipage/browsers.html#browsing-context</a><b>Referenced in:</b>
    <ul>
@@ -7957,6 +8871,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-in-parallel">5.9. Permissions Policy integration</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-the-input-element">
+   <a href="https://html.spec.whatwg.org/multipage/input.html#the-input-element">https://html.spec.whatwg.org/multipage/input.html#the-input-element</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-the-input-element">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-the-input-element①">(2)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-is-a-registrable-domain-suffix-of-or-is-equal-to">
    <a href="https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to">https://html.spec.whatwg.org/multipage/origin.html#is-a-registrable-domain-suffix-of-or-is-equal-to</a><b>Referenced in:</b>
    <ul>
@@ -8015,6 +8935,13 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://html.spec.whatwg.org/multipage/webappapis.html#secure-context">https://html.spec.whatwg.org/multipage/webappapis.html#secure-context</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-secure-context">5. Web Authentication API</a>
+    <li><a href="#ref-for-secure-context①">13.4.8. Code injection attacks</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-the-textarea-element">
+   <a href="https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element">https://html.spec.whatwg.org/multipage/form-elements.html#the-textarea-element</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-the-textarea-element">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-concept-origin-tuple">
@@ -8028,7 +8955,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-set-append">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-set-append①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-set-append②">(2)</a>
-    <li><a href="#ref-for-set-append③">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-set-append④">(2)</a>
+    <li><a href="#ref-for-set-append③">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-set-append④">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-set-append⑤">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-boolean">
@@ -8050,16 +8978,25 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-iteration-continue">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-iteration-continue①">(2)</a> <a href="#ref-for-iteration-continue②">(3)</a> <a href="#ref-for-iteration-continue③">(4)</a> <a href="#ref-for-iteration-continue④">(5)</a> <a href="#ref-for-iteration-continue⑤">(6)</a> <a href="#ref-for-iteration-continue⑥">(7)</a> <a href="#ref-for-iteration-continue⑦">(8)</a> <a href="#ref-for-iteration-continue⑧">(9)</a> <a href="#ref-for-iteration-continue⑨">(10)</a>
     <li><a href="#ref-for-iteration-continue①⓪">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-iteration-continue①①">(2)</a> <a href="#ref-for-iteration-continue①②">(3)</a> <a href="#ref-for-iteration-continue①③">(4)</a> <a href="#ref-for-iteration-continue①④">(5)</a>
-    <li><a href="#ref-for-iteration-continue①⑤">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-iteration-continue①⑤">6.3.5. The silentCredentialDiscovery operation</a> <a href="#ref-for-iteration-continue①⑥">(2)</a>
+    <li><a href="#ref-for-iteration-continue①⑦">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-list-empty">
    <a href="https://infra.spec.whatwg.org/#list-empty">https://infra.spec.whatwg.org/#list-empty</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-list-empty">4. Terminology</a>
-    <li><a href="#ref-for-list-empty①">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-list-empty②">(2)</a>
-    <li><a href="#ref-for-list-empty③">13.4.7. Unprotected account detection</a>
-    <li><a href="#ref-for-list-empty④">14.6.3. Privacy leak via credential IDs</a>
+    <li><a href="#ref-for-list-empty①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-list-empty②">(2)</a>
+    <li><a href="#ref-for-list-empty③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-list-empty④">(2)</a>
+    <li><a href="#ref-for-list-empty⑤">13.4.7. Unprotected account detection</a>
+    <li><a href="#ref-for-list-empty⑥">14.6.3. Privacy leak via credential IDs</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-map-entry">
+   <a href="https://infra.spec.whatwg.org/#map-entry">https://infra.spec.whatwg.org/#map-entry</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-map-entry">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-map-entry①">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-map-exists">
@@ -8069,6 +9006,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-map-exists①">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-map-exists②">(2)</a> <a href="#ref-for-map-exists③">(3)</a>
     <li><a href="#ref-for-map-exists④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
     <li><a href="#ref-for-map-exists⑤">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
+    <li><a href="#ref-for-map-exists⑥">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-map-iterate">
@@ -8079,6 +9017,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-map-iterate②">6.3.1. Lookup Credential Source by Credential ID Algorithm</a>
     <li><a href="#ref-for-map-iterate③">6.3.2. The authenticatorMakeCredential Operation</a>
     <li><a href="#ref-for-map-iterate④">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-map-iterate⑤">(2)</a>
+    <li><a href="#ref-for-map-iterate⑥">6.3.5. The silentCredentialDiscovery operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-list-is-empty">
@@ -8086,7 +9025,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-list-is-empty">4. Terminology</a> <a href="#ref-for-list-is-empty①">(2)</a>
     <li><a href="#ref-for-list-is-empty②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-list-is-empty③">(2)</a>
-    <li><a href="#ref-for-list-is-empty④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-list-is-empty⑤">(2)</a> <a href="#ref-for-list-is-empty⑥">(3)</a> <a href="#ref-for-list-is-empty⑦">(4)</a> <a href="#ref-for-list-is-empty⑧">(5)</a>
+    <li><a href="#ref-for-list-is-empty④">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-list-is-empty⑤">(2)</a> <a href="#ref-for-list-is-empty⑥">(3)</a> <a href="#ref-for-list-is-empty⑦">(4)</a> <a href="#ref-for-list-is-empty⑧">(5)</a>
     <li><a href="#ref-for-list-is-empty⑨">7.2. Verifying an Authentication Assertion</a>
    </ul>
   </aside>
@@ -8095,16 +9034,23 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-list-is-empty">4. Terminology</a> <a href="#ref-for-list-is-empty①">(2)</a>
     <li><a href="#ref-for-list-is-empty②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-list-is-empty③">(2)</a>
-    <li><a href="#ref-for-list-is-empty④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-list-is-empty⑤">(2)</a> <a href="#ref-for-list-is-empty⑥">(3)</a> <a href="#ref-for-list-is-empty⑦">(4)</a> <a href="#ref-for-list-is-empty⑧">(5)</a>
+    <li><a href="#ref-for-list-is-empty④">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-list-is-empty⑤">(2)</a> <a href="#ref-for-list-is-empty⑥">(3)</a> <a href="#ref-for-list-is-empty⑦">(4)</a> <a href="#ref-for-list-is-empty⑧">(5)</a>
     <li><a href="#ref-for-list-is-empty⑨">7.2. Verifying an Authentication Assertion</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-struct-item">
    <a href="https://infra.spec.whatwg.org/#struct-item">https://infra.spec.whatwg.org/#struct-item</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-struct-item">4. Terminology</a> <a href="#ref-for-struct-item①">(2)</a>
-    <li><a href="#ref-for-struct-item②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-struct-item③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-struct-item">4. Terminology</a> <a href="#ref-for-struct-item①">(2)</a> <a href="#ref-for-struct-item②">(3)</a> <a href="#ref-for-struct-item③">(4)</a> <a href="#ref-for-struct-item④">(5)</a> <a href="#ref-for-struct-item⑤">(6)</a> <a href="#ref-for-struct-item⑥">(7)</a> <a href="#ref-for-struct-item⑦">(8)</a>
+    <li><a href="#ref-for-struct-item⑧">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-struct-item⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-struct-item①⓪">6.3.5. The silentCredentialDiscovery operation</a> <a href="#ref-for-struct-item①①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-map-key">
+   <a href="https://infra.spec.whatwg.org/#map-key">https://infra.spec.whatwg.org/#map-key</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-map-key">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-list">
@@ -8112,7 +9058,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-list">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-list①">(2)</a>
     <li><a href="#ref-for-list②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-list③">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-list③">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-list④">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-list⑤">6.3.5. The silentCredentialDiscovery operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-ordered-map">
@@ -8120,18 +9068,20 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-ordered-map">5.1. PublicKeyCredential Interface</a>
     <li><a href="#ref-for-ordered-map①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-ordered-map②">(2)</a>
-    <li><a href="#ref-for-ordered-map③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-ordered-map④">(2)</a> <a href="#ref-for-ordered-map⑤">(3)</a>
-    <li><a href="#ref-for-ordered-map⑥">6. WebAuthn Authenticator Model</a>
-    <li><a href="#ref-for-ordered-map⑦">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-ordered-map⑧">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-ordered-map⑨">9.4. Client Extension Processing</a>
+    <li><a href="#ref-for-ordered-map③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-ordered-map④">(2)</a> <a href="#ref-for-ordered-map⑤">(3)</a> <a href="#ref-for-ordered-map⑥">(4)</a>
+    <li><a href="#ref-for-ordered-map⑦">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-ordered-map⑧">(2)</a>
+    <li><a href="#ref-for-ordered-map⑨">6. WebAuthn Authenticator Model</a>
+    <li><a href="#ref-for-ordered-map①⓪">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-ordered-map①①">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-ordered-map①②">9.4. Client Extension Processing</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-ordered-set">
    <a href="https://infra.spec.whatwg.org/#ordered-set">https://infra.spec.whatwg.org/#ordered-set</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-ordered-set">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-ordered-set①">(2)</a>
-    <li><a href="#ref-for-ordered-set②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-ordered-set③">(2)</a> <a href="#ref-for-ordered-set④">(3)</a> <a href="#ref-for-ordered-set⑤">(4)</a>
+    <li><a href="#ref-for-ordered-set②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-ordered-set③">(2)</a>
+    <li><a href="#ref-for-ordered-set④">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-ordered-set⑤">(2)</a>
     <li><a href="#ref-for-ordered-set⑥">6.3.3. The authenticatorGetAssertion Operation</a>
    </ul>
   </aside>
@@ -8153,9 +9103,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://infra.spec.whatwg.org/#map-set">https://infra.spec.whatwg.org/#map-set</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-map-set">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-map-set①">(2)</a>
-    <li><a href="#ref-for-map-set②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-map-set③">(2)</a>
-    <li><a href="#ref-for-map-set④">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-map-set⑤">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-map-set②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-map-set③">(2)</a> <a href="#ref-for-map-set④">(3)</a>
+    <li><a href="#ref-for-map-set⑤">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-map-set⑥">10.1.3. Credential Properties Extension (credProps)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-list-size">
@@ -8167,9 +9117,16 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-struct">
    <a href="https://infra.spec.whatwg.org/#struct">https://infra.spec.whatwg.org/#struct</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-struct">4. Terminology</a>
-    <li><a href="#ref-for-struct①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-struct②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-struct">4. Terminology</a> <a href="#ref-for-struct①">(2)</a>
+    <li><a href="#ref-for-struct②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-struct③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-struct④">6.3.5. The silentCredentialDiscovery operation</a> <a href="#ref-for-struct⑤">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-map-value">
+   <a href="https://infra.spec.whatwg.org/#map-value">https://infra.spec.whatwg.org/#map-value</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-map-value">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-iteration-while">
@@ -8208,6 +9165,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-page-186">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
     <li><a href="#ref-for-page-186①">13.4.4. Attestation Limitations</a> <a href="#ref-for-page-186②">(2)</a> <a href="#ref-for-page-186③">(3)</a> <a href="#ref-for-page-186④">(4)</a> <a href="#ref-for-page-186⑤">(5)</a> <a href="#ref-for-page-186⑥">(6)</a>
+    <li><a href="#ref-for-page-186⑦">13.4.8. Code injection attacks</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-page-258">
@@ -8461,8 +9419,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://w3c.github.io/webdriver/#dfn-endpoint-node">https://w3c.github.io/webdriver/#dfn-endpoint-node</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dfn-endpoint-node">11.1. WebAuthn WebDriver Extension Capability</a> <a href="#ref-for-dfn-endpoint-node①">(2)</a>
-    <li><a href="#ref-for-dfn-endpoint-node②">11.1.1. Authenticator Extension Capabilities</a> <a href="#ref-for-dfn-endpoint-node③">(2)</a> <a href="#ref-for-dfn-endpoint-node④">(3)</a> <a href="#ref-for-dfn-endpoint-node⑤">(4)</a>
-    <li><a href="#ref-for-dfn-endpoint-node⑥">11.3. Add Virtual Authenticator</a>
+    <li><a href="#ref-for-dfn-endpoint-node②">11.1.1. Authenticator Extension Capabilities</a> <a href="#ref-for-dfn-endpoint-node③">(2)</a> <a href="#ref-for-dfn-endpoint-node④">(3)</a> <a href="#ref-for-dfn-endpoint-node⑤">(4)</a> <a href="#ref-for-dfn-endpoint-node⑥">(5)</a>
+    <li><a href="#ref-for-dfn-endpoint-node⑦">11.3. Add Virtual Authenticator</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dfn-extension-capability">
@@ -8588,14 +9546,15 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-idl-ArrayBuffer">
    <a href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer">https://webidl.spec.whatwg.org/#idl-ArrayBuffer</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-ArrayBuffer">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-idl-ArrayBuffer①">(2)</a>
-    <li><a href="#ref-for-idl-ArrayBuffer②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-ArrayBuffer③">(2)</a> <a href="#ref-for-idl-ArrayBuffer④">(3)</a>
-    <li><a href="#ref-for-idl-ArrayBuffer⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-ArrayBuffer⑥">(2)</a> <a href="#ref-for-idl-ArrayBuffer⑦">(3)</a> <a href="#ref-for-idl-ArrayBuffer⑧">(4)</a> <a href="#ref-for-idl-ArrayBuffer⑨">(5)</a> <a href="#ref-for-idl-ArrayBuffer①⓪">(6)</a>
-    <li><a href="#ref-for-idl-ArrayBuffer①①">5.2. Authenticator Responses (interface AuthenticatorResponse)</a> <a href="#ref-for-idl-ArrayBuffer①②">(2)</a>
-    <li><a href="#ref-for-idl-ArrayBuffer①③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-idl-ArrayBuffer①④">(2)</a> <a href="#ref-for-idl-ArrayBuffer①⑤">(3)</a> <a href="#ref-for-idl-ArrayBuffer①⑥">(4)</a>
-    <li><a href="#ref-for-idl-ArrayBuffer①⑦">5.2.1.1. Easily accessing credential data</a>
-    <li><a href="#ref-for-idl-ArrayBuffer①⑧">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a> <a href="#ref-for-idl-ArrayBuffer①⑨">(2)</a> <a href="#ref-for-idl-ArrayBuffer②⓪">(3)</a> <a href="#ref-for-idl-ArrayBuffer②①">(4)</a> <a href="#ref-for-idl-ArrayBuffer②②">(5)</a> <a href="#ref-for-idl-ArrayBuffer②③">(6)</a>
-    <li><a href="#ref-for-idl-ArrayBuffer②④">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-ArrayBuffer②⑤">(2)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-idl-ArrayBuffer①">(2)</a> <a href="#ref-for-idl-ArrayBuffer②">(3)</a> <a href="#ref-for-idl-ArrayBuffer③">(4)</a> <a href="#ref-for-idl-ArrayBuffer④">(5)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer⑤">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-ArrayBuffer⑥">(2)</a> <a href="#ref-for-idl-ArrayBuffer⑦">(3)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer⑧">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-ArrayBuffer⑨">(2)</a> <a href="#ref-for-idl-ArrayBuffer①⓪">(3)</a> <a href="#ref-for-idl-ArrayBuffer①①">(4)</a> <a href="#ref-for-idl-ArrayBuffer①②">(5)</a> <a href="#ref-for-idl-ArrayBuffer①③">(6)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer①④">5.2. Authenticator Responses (interface AuthenticatorResponse)</a> <a href="#ref-for-idl-ArrayBuffer①⑤">(2)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer①⑥">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-idl-ArrayBuffer①⑦">(2)</a> <a href="#ref-for-idl-ArrayBuffer①⑧">(3)</a> <a href="#ref-for-idl-ArrayBuffer①⑨">(4)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer②⓪">5.2.1.1. Easily accessing credential data</a>
+    <li><a href="#ref-for-idl-ArrayBuffer②①">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a> <a href="#ref-for-idl-ArrayBuffer②②">(2)</a> <a href="#ref-for-idl-ArrayBuffer②③">(3)</a> <a href="#ref-for-idl-ArrayBuffer②④">(4)</a> <a href="#ref-for-idl-ArrayBuffer②⑤">(5)</a> <a href="#ref-for-idl-ArrayBuffer②⑥">(6)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer②⑦">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-idl-ArrayBuffer②⑧">(2)</a> <a href="#ref-for-idl-ArrayBuffer②⑨">(3)</a>
+    <li><a href="#ref-for-idl-ArrayBuffer③⓪">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-ArrayBuffer③①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-BufferSource">
@@ -8607,7 +9566,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-BufferSource④">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-BufferSource⑤">(2)</a>
     <li><a href="#ref-for-BufferSource⑥">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-BufferSource⑦">(2)</a>
     <li><a href="#ref-for-BufferSource⑧">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-BufferSource⑨">(2)</a>
-    <li><a href="#ref-for-BufferSource①⓪">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-BufferSource①①">(2)</a>
+    <li><a href="#ref-for-BufferSource①⓪">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-BufferSource①①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-constrainterror">
@@ -8621,31 +9580,43 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-idl-DOMException">3. Dependencies</a>
     <li><a href="#ref-for-idl-DOMException①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-DOMException②">(2)</a> <a href="#ref-for-idl-DOMException③">(3)</a> <a href="#ref-for-idl-DOMException④">(4)</a> <a href="#ref-for-idl-DOMException⑤">(5)</a> <a href="#ref-for-idl-DOMException⑥">(6)</a> <a href="#ref-for-idl-DOMException⑦">(7)</a> <a href="#ref-for-idl-DOMException⑧">(8)</a>
-    <li><a href="#ref-for-idl-DOMException⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-DOMException①⓪">(2)</a> <a href="#ref-for-idl-DOMException①①">(3)</a> <a href="#ref-for-idl-DOMException①②">(4)</a> <a href="#ref-for-idl-DOMException①③">(5)</a> <a href="#ref-for-idl-DOMException①④">(6)</a>
-    <li><a href="#ref-for-idl-DOMException①⑤">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-idl-DOMException①⑥">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-idl-DOMException①⑦">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-idl-DOMException①⑧">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-idl-DOMException①⑨">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-DOMException②⓪">(2)</a> <a href="#ref-for-idl-DOMException②①">(3)</a> <a href="#ref-for-idl-DOMException②②">(4)</a>
+    <li><a href="#ref-for-idl-DOMException⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-idl-DOMException①⓪">(2)</a> <a href="#ref-for-idl-DOMException①①">(3)</a> <a href="#ref-for-idl-DOMException①②">(4)</a> <a href="#ref-for-idl-DOMException①③">(5)</a> <a href="#ref-for-idl-DOMException①④">(6)</a> <a href="#ref-for-idl-DOMException①⑤">(7)</a>
+    <li><a href="#ref-for-idl-DOMException①⑥">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-idl-DOMException①⑦">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-idl-DOMException①⑧">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-idl-DOMException①⑨">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-idl-DOMException②⓪">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-idl-DOMException②①">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-idl-DOMException②②">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-idl-DOMException②③">(2)</a> <a href="#ref-for-idl-DOMException②④">(3)</a>
+    <li><a href="#ref-for-idl-DOMException②⑤">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-DOMException②⑥">(2)</a> <a href="#ref-for-idl-DOMException②⑦">(3)</a> <a href="#ref-for-idl-DOMException②⑧">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-DOMString">
    <a href="https://webidl.spec.whatwg.org/#idl-DOMString">https://webidl.spec.whatwg.org/#idl-DOMString</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-idl-DOMString">2.1.1. Enumerations as DOMString types</a>
-    <li><a href="#ref-for-idl-DOMString①">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-idl-DOMString②">(2)</a>
-    <li><a href="#ref-for-idl-DOMString③">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-idl-DOMString④">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-idl-DOMString⑤">(2)</a>
-    <li><a href="#ref-for-idl-DOMString⑥">5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)</a> <a href="#ref-for-idl-DOMString⑦">(2)</a>
-    <li><a href="#ref-for-idl-DOMString⑧">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-idl-DOMString⑨">(2)</a>
-    <li><a href="#ref-for-idl-DOMString①⓪">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-idl-DOMString①①">(2)</a>
-    <li><a href="#ref-for-idl-DOMString①②">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> <a href="#ref-for-idl-DOMString①③">(2)</a>
-    <li><a href="#ref-for-idl-DOMString①④">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-idl-DOMString①⑤">(2)</a>
-    <li><a href="#ref-for-idl-DOMString①⑥">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-idl-DOMString①⑦">(2)</a> <a href="#ref-for-idl-DOMString①⑧">(3)</a> <a href="#ref-for-idl-DOMString①⑨">(4)</a> <a href="#ref-for-idl-DOMString②⓪">(5)</a> <a href="#ref-for-idl-DOMString②①">(6)</a>
-    <li><a href="#ref-for-idl-DOMString②②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-idl-DOMString②③">(2)</a>
-    <li><a href="#ref-for-idl-DOMString②④">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-idl-DOMString②⑤">(2)</a> <a href="#ref-for-idl-DOMString②⑥">(3)</a> <a href="#ref-for-idl-DOMString②⑦">(4)</a> <a href="#ref-for-idl-DOMString②⑧">(5)</a> <a href="#ref-for-idl-DOMString②⑨">(6)</a> <a href="#ref-for-idl-DOMString③⓪">(7)</a> <a href="#ref-for-idl-DOMString③①">(8)</a> <a href="#ref-for-idl-DOMString③②">(9)</a> <a href="#ref-for-idl-DOMString③③">(10)</a>
-    <li><a href="#ref-for-idl-DOMString③④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-idl-DOMString③⑤">(2)</a> <a href="#ref-for-idl-DOMString③⑥">(3)</a> <a href="#ref-for-idl-DOMString③⑦">(4)</a>
-    <li><a href="#ref-for-idl-DOMString③⑧">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-DOMString③⑨">(2)</a>
+    <li><a href="#ref-for-idl-DOMString①">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-idl-DOMString②">(2)</a> <a href="#ref-for-idl-DOMString③">(3)</a> <a href="#ref-for-idl-DOMString④">(4)</a> <a href="#ref-for-idl-DOMString⑤">(5)</a> <a href="#ref-for-idl-DOMString⑥">(6)</a> <a href="#ref-for-idl-DOMString⑦">(7)</a> <a href="#ref-for-idl-DOMString⑧">(8)</a> <a href="#ref-for-idl-DOMString⑨">(9)</a> <a href="#ref-for-idl-DOMString①⓪">(10)</a>
+    <li><a href="#ref-for-idl-DOMString①①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-idl-DOMString①②">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-idl-DOMString①③">(2)</a> <a href="#ref-for-idl-DOMString①④">(3)</a> <a href="#ref-for-idl-DOMString①⑤">(4)</a> <a href="#ref-for-idl-DOMString①⑥">(5)</a> <a href="#ref-for-idl-DOMString①⑦">(6)</a>
+    <li><a href="#ref-for-idl-DOMString①⑧">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a> <a href="#ref-for-idl-DOMString①⑨">(2)</a> <a href="#ref-for-idl-DOMString②⓪">(3)</a>
+    <li><a href="#ref-for-idl-DOMString②①">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-idl-DOMString②②">(2)</a>
+    <li><a href="#ref-for-idl-DOMString②③">5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)</a> <a href="#ref-for-idl-DOMString②④">(2)</a>
+    <li><a href="#ref-for-idl-DOMString②⑤">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-idl-DOMString②⑥">(2)</a>
+    <li><a href="#ref-for-idl-DOMString②⑦">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-idl-DOMString②⑧">(2)</a>
+    <li><a href="#ref-for-idl-DOMString②⑨">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> <a href="#ref-for-idl-DOMString③⓪">(2)</a>
+    <li><a href="#ref-for-idl-DOMString③①">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-idl-DOMString③②">(2)</a>
+    <li><a href="#ref-for-idl-DOMString③③">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-idl-DOMString③④">(2)</a> <a href="#ref-for-idl-DOMString③⑤">(3)</a> <a href="#ref-for-idl-DOMString③⑥">(4)</a> <a href="#ref-for-idl-DOMString③⑦">(5)</a> <a href="#ref-for-idl-DOMString③⑧">(6)</a>
+    <li><a href="#ref-for-idl-DOMString③⑨">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-idl-DOMString④⓪">(2)</a>
+    <li><a href="#ref-for-idl-DOMString④①">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-idl-DOMString④②">(2)</a> <a href="#ref-for-idl-DOMString④③">(3)</a> <a href="#ref-for-idl-DOMString④④">(4)</a> <a href="#ref-for-idl-DOMString④⑤">(5)</a> <a href="#ref-for-idl-DOMString④⑥">(6)</a> <a href="#ref-for-idl-DOMString④⑦">(7)</a> <a href="#ref-for-idl-DOMString④⑧">(8)</a> <a href="#ref-for-idl-DOMString④⑨">(9)</a> <a href="#ref-for-idl-DOMString⑤⓪">(10)</a>
+    <li><a href="#ref-for-idl-DOMString⑤①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-idl-DOMString⑤②">(2)</a> <a href="#ref-for-idl-DOMString⑤③">(3)</a> <a href="#ref-for-idl-DOMString⑤④">(4)</a>
+    <li><a href="#ref-for-idl-DOMString⑤⑤">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-DOMString⑤⑥">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-encodingerror">
+   <a href="https://webidl.spec.whatwg.org/#encodingerror">https://webidl.spec.whatwg.org/#encodingerror</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-encodingerror">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-encodingerror①">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-Exposed">
@@ -8663,7 +9634,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-invalidstateerror">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-invalidstateerror①">(2)</a> <a href="#ref-for-invalidstateerror②">(3)</a>
     <li><a href="#ref-for-invalidstateerror③">6.3.2. The authenticatorMakeCredential Operation</a>
     <li><a href="#ref-for-invalidstateerror④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-invalidstateerror⑤">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-invalidstateerror⑤">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-notallowederror">
@@ -8680,19 +9651,22 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://webidl.spec.whatwg.org/#notsupportederror">https://webidl.spec.whatwg.org/#notsupportederror</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-notsupportederror">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-notsupportederror①">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-notsupportederror②">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-notsupportederror③">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-notsupportederror④">(2)</a> <a href="#ref-for-notsupportederror⑤">(3)</a> <a href="#ref-for-notsupportederror⑥">(4)</a>
+    <li><a href="#ref-for-notsupportederror①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-notsupportederror②">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-notsupportederror③">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-notsupportederror④">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-notsupportederror⑤">(2)</a> <a href="#ref-for-notsupportederror⑥">(3)</a>
+    <li><a href="#ref-for-notsupportederror⑦">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-notsupportederror⑧">(2)</a> <a href="#ref-for-notsupportederror⑨">(3)</a> <a href="#ref-for-notsupportederror①⓪">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-promise">
    <a href="https://webidl.spec.whatwg.org/#idl-promise">https://webidl.spec.whatwg.org/#idl-promise</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-idl-promise">3. Dependencies</a>
-    <li><a href="#ref-for-idl-promise①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-idl-promise②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-idl-promise③">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-idl-promise④">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-idl-promise①">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-idl-promise②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-idl-promise③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-idl-promise④">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-idl-promise⑤">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-SameObject">
@@ -8718,8 +9692,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <ul>
     <li><a href="#ref-for-securityerror">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-securityerror①">(2)</a>
     <li><a href="#ref-for-securityerror②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-securityerror③">(2)</a>
-    <li><a href="#ref-for-securityerror④">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-securityerror⑤">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-securityerror④">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-securityerror⑤">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-exceptiondef-typeerror">
@@ -8732,8 +9706,9 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://webidl.spec.whatwg.org/#idl-USVString">https://webidl.spec.whatwg.org/#idl-USVString</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-idl-USVString">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-idl-USVString①">(2)</a>
-    <li><a href="#ref-for-idl-USVString②">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-idl-USVString③">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-idl-USVString②">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-idl-USVString③">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-idl-USVString④">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-idl-USVString⑤">(2)</a> <a href="#ref-for-idl-USVString⑥">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-unknownerror">
@@ -8746,14 +9721,23 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
   <aside class="dfn-panel" data-for="term-for-idl-boolean">
    <a href="https://webidl.spec.whatwg.org/#idl-boolean">https://webidl.spec.whatwg.org/#idl-boolean</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-boolean">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-idl-boolean①">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-idl-boolean②">(2)</a>
-    <li><a href="#ref-for-idl-boolean③">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-idl-boolean④">(2)</a>
-    <li><a href="#ref-for-idl-boolean⑤">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-idl-boolean⑥">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-idl-boolean⑦">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-idl-boolean⑧">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-idl-boolean⑨">(2)</a> <a href="#ref-for-idl-boolean①⓪">(3)</a>
-    <li><a href="#ref-for-idl-boolean①①">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-boolean①②">(2)</a> <a href="#ref-for-idl-boolean①③">(3)</a> <a href="#ref-for-idl-boolean①④">(4)</a> <a href="#ref-for-idl-boolean①⑤">(5)</a> <a href="#ref-for-idl-boolean①⑥">(6)</a>
+    <li><a href="#ref-for-idl-boolean">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-idl-boolean①">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-idl-boolean②">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-idl-boolean③">(2)</a>
+    <li><a href="#ref-for-idl-boolean④">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-idl-boolean⑤">(2)</a>
+    <li><a href="#ref-for-idl-boolean⑥">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-idl-boolean⑦">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-idl-boolean⑧">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-idl-boolean⑨">(2)</a> <a href="#ref-for-idl-boolean①⓪">(3)</a>
+    <li><a href="#ref-for-idl-boolean①①">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-idl-boolean①②">(2)</a>
+    <li><a href="#ref-for-idl-boolean①③">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-idl-boolean①④">(2)</a> <a href="#ref-for-idl-boolean①⑤">(3)</a> <a href="#ref-for-idl-boolean①⑥">(4)</a> <a href="#ref-for-idl-boolean①⑦">(5)</a> <a href="#ref-for-idl-boolean①⑧">(6)</a>
+    <li><a href="#ref-for-idl-boolean①⑨">10.2.1. User Verification Method Extension (uvm)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="term-for-dfn-buffer-source-type">
+   <a href="https://webidl.spec.whatwg.org/#dfn-buffer-source-type">https://webidl.spec.whatwg.org/#dfn-buffer-source-type</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dfn-buffer-source-type">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-dfn-buffer-source-type①">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-dfn-get-buffer-source-reference">
@@ -8770,28 +9754,47 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
     <li><a href="#ref-for-dfn-interface-object③">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-dfn-json-types">
+   <a href="https://webidl.spec.whatwg.org/#dfn-json-types">https://webidl.spec.whatwg.org/#dfn-json-types</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dfn-json-types">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-dfn-json-types①">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-dfn-json-types②">(2)</a>
+    <li><a href="#ref-for-dfn-json-types③">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a> <a href="#ref-for-dfn-json-types④">(2)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-idl-long">
    <a href="https://webidl.spec.whatwg.org/#idl-long">https://webidl.spec.whatwg.org/#idl-long</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-idl-long">5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="term-for-idl-record">
+   <a href="https://webidl.spec.whatwg.org/#idl-record">https://webidl.spec.whatwg.org/#idl-record</a><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-idl-record">10.1.4. Pseudo-random function extension (prf)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="term-for-idl-sequence">
    <a href="https://webidl.spec.whatwg.org/#idl-sequence">https://webidl.spec.whatwg.org/#idl-sequence</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-sequence">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-idl-sequence①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-idl-sequence②">(2)</a>
-    <li><a href="#ref-for-idl-sequence③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-idl-sequence④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
-    <li><a href="#ref-for-idl-sequence⑤">10.3. User Verification Method Extension (uvm)</a> <a href="#ref-for-idl-sequence⑥">(2)</a>
+    <li><a href="#ref-for-idl-sequence">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-idl-sequence①">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-idl-sequence②">(2)</a> <a href="#ref-for-idl-sequence③">(3)</a>
+    <li><a href="#ref-for-idl-sequence④">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-idl-sequence⑤">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-idl-sequence⑥">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-idl-sequence⑦">(2)</a>
+    <li><a href="#ref-for-idl-sequence⑧">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-idl-sequence⑨">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
+    <li><a href="#ref-for-idl-sequence①⓪">10.2.1. User Verification Method Extension (uvm)</a> <a href="#ref-for-idl-sequence①①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-idl-unsigned-long">
    <a href="https://webidl.spec.whatwg.org/#idl-unsigned-long">https://webidl.spec.whatwg.org/#idl-unsigned-long</a><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-idl-unsigned-long">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-idl-unsigned-long①">(2)</a>
-    <li><a href="#ref-for-idl-unsigned-long②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-idl-unsigned-long③">(2)</a>
-    <li><a href="#ref-for-idl-unsigned-long④">10.3. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-idl-unsigned-long">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-idl-unsigned-long①">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-idl-unsigned-long②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-idl-unsigned-long③">(2)</a>
+    <li><a href="#ref-for-idl-unsigned-long④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-idl-unsigned-long⑤">(2)</a>
+    <li><a href="#ref-for-idl-unsigned-long⑥">10.2.1. User Verification Method Extension (uvm)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="term-for-focus">
@@ -8804,12 +9807,39 @@ <h3 class="no-num no-ref heading settled" id="index-defined-here"><span class="c
    <a href="https://url.spec.whatwg.org/#host-same-site">https://url.spec.whatwg.org/#host-same-site</a><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-host-same-site">3. Dependencies</a>
-    <li><a href="#ref-for-host-same-site①">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-host-same-site②">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-host-same-site①">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-host-same-site②">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
    </ul>
   </aside>
   <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span class="content">Terms defined by reference</span><a class="self-link" href="#index-defined-elsewhere"></a></h3>
   <ul class="index">
+   <li>
+    <a data-link-type="biblio">[CREDENTIAL-MANAGEMENT-1]</a> defines the following terms:
+    <ul>
+     <li><span class="dfn-paneled" id="term-for-credential">Credential</span>
+     <li><span class="dfn-paneled" id="term-for-dictdef-credentialcreationoptions">CredentialCreationOptions</span>
+     <li><span class="dfn-paneled" id="term-for-dictdef-credentialrequestoptions">CredentialRequestOptions</span>
+     <li><span class="dfn-paneled" id="term-for-credentialscontainer">CredentialsContainer</span>
+     <li><span class="dfn-paneled" id="term-for-abstract-opdef-request-a-credential">Request a Credential</span>
+     <li><span class="dfn-paneled" id="term-for-collectfromcredentialstore-origin-options-sameoriginwithancestors">[[CollectFromCredentialStore]](origin, options, sameOriginWithAncestors)</span>
+     <li><span class="dfn-paneled" id="term-for-create-origin-options-sameoriginwithancestors">[[Create]](origin, options, sameOriginWithAncestors)</span>
+     <li><span class="dfn-paneled" id="term-for-store-credential-sameoriginwithancestors">[[Store]](credential, sameOriginWithAncestors)</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credential-discovery-slot">[[discovery]]</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credential-type-slot">[[type]]</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credentialmediationrequirement-conditional">conditional</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credentialscontainer-create">create()</span>
+     <li><span class="dfn-paneled" id="term-for-concept-credential">credential</span>
+     <li><span class="dfn-paneled" id="term-for-credential-source">credential source</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credentialscontainer-get">get()</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credential-id">id</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credentialrequestoptions-mediation">mediation</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credential-discovery-remote">remote</span>
+     <li><span class="dfn-paneled" id="term-for-same-origin-with-its-ancestors">same-origin with its ancestors</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credentialrequestoptions-signal">signal <small>(for CredentialRequestOptions)</small></span>
+     <li><span class="dfn-paneled" id="term-for-dom-credentialscontainer-store">store()</span>
+     <li><span class="dfn-paneled" id="term-for-dom-credential-type">type</span>
+     <li><span class="dfn-paneled" id="term-for-user-mediated">user mediation</span>
+    </ul>
    <li>
     <a data-link-type="biblio">[DOM4]</a> defines the following terms:
     <ul>
@@ -8878,6 +9908,8 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-attr-iframe-allow">allow</span>
      <li><span class="dfn-paneled" id="term-for-allowed-to-use">allowed to use</span>
      <li><span class="dfn-paneled" id="term-for-ascii-serialisation-of-an-origin">ascii serialization of an origin</span>
+     <li><span class="dfn-paneled" id="term-for-attr-fe-autocomplete">autocomplete</span>
+     <li><span class="dfn-paneled" id="term-for-autofill-detail-tokens">autofill detail token</span>
      <li><span class="dfn-paneled" id="term-for-browsing-context">browsing context</span>
      <li><span class="dfn-paneled" id="term-for-current-settings-object">current settings object</span>
      <li><span class="dfn-paneled" id="term-for-dom-document-domain">document.domain</span>
@@ -8886,6 +9918,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-concept-settings-object-global">global object</span>
      <li><span class="dfn-paneled" id="term-for-the-iframe-element">iframe</span>
      <li><span class="dfn-paneled" id="term-for-in-parallel">in parallel</span>
+     <li><span class="dfn-paneled" id="term-for-the-input-element">input</span>
      <li><span class="dfn-paneled" id="term-for-is-a-registrable-domain-suffix-of-or-is-equal-to">is a registrable domain suffix of or is equal to</span>
      <li><span class="dfn-paneled" id="term-for-is-a-registrable-domain-suffix-of-or-is-equal-to①">is not a registrable domain suffix of and is not equal to</span>
      <li><span class="dfn-paneled" id="term-for-concept-origin-opaque">opaque origin</span>
@@ -8893,6 +9926,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-concept-document-permissions-policy">permissions policy</span>
      <li><span class="dfn-paneled" id="term-for-relevant-settings-object">relevant settings object</span>
      <li><span class="dfn-paneled" id="term-for-secure-context">secure context</span>
+     <li><span class="dfn-paneled" id="term-for-the-textarea-element">textarea</span>
      <li><span class="dfn-paneled" id="term-for-concept-origin-tuple">tuple origin</span>
     </ul>
    <li>
@@ -8903,11 +9937,13 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-byte-sequence">byte sequence</span>
      <li><span class="dfn-paneled" id="term-for-iteration-continue">continue</span>
      <li><span class="dfn-paneled" id="term-for-list-empty">empty</span>
+     <li><span class="dfn-paneled" id="term-for-map-entry">entry</span>
      <li><span class="dfn-paneled" id="term-for-map-exists">exist</span>
      <li><span class="dfn-paneled" id="term-for-map-iterate">for each <small>(for map)</small></span>
      <li><span class="dfn-paneled" id="term-for-list-is-empty">is empty</span>
      <li><span class="dfn-paneled" id="term-for-list-is-empty①">is not empty</span>
      <li><span class="dfn-paneled" id="term-for-struct-item">item <small>(for struct)</small></span>
+     <li><span class="dfn-paneled" id="term-for-map-key">key</span>
      <li><span class="dfn-paneled" id="term-for-list">list</span>
      <li><span class="dfn-paneled" id="term-for-ordered-map">map</span>
      <li><span class="dfn-paneled" id="term-for-ordered-set">ordered set</span>
@@ -8916,11 +9952,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-map-set">set <small>(for map)</small></span>
      <li><span class="dfn-paneled" id="term-for-list-size">size</span>
      <li><span class="dfn-paneled" id="term-for-struct">struct</span>
+     <li><span class="dfn-paneled" id="term-for-map-value">value</span>
      <li><span class="dfn-paneled" id="term-for-iteration-while">while</span>
      <li><span class="dfn-paneled" id="term-for-willful-violation">willful violation</span>
     </ul>
    <li>
-    <a data-link-type="biblio">[page-visibility]</a> defines the following terms:
+    <a data-link-type="biblio">[PAGE-VISIBILITY]</a> defines the following terms:
     <ul>
      <li><span class="dfn-paneled" id="term-for-visibility-states">visibility states</span>
     </ul>
@@ -8943,7 +9980,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-section-4.1.2.7">subjectpublickeyinfo</span>
     </ul>
    <li>
-    <a data-link-type="biblio">[rfc5646]</a> defines the following terms:
+    <a data-link-type="biblio">[RFC5646]</a> defines the following terms:
     <ul>
      <li><span class="dfn-paneled" id="term-for-section-2.1">language tag</span>
     </ul>
@@ -9034,6 +10071,7 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-constrainterror">ConstraintError</span>
      <li><span class="dfn-paneled" id="term-for-idl-DOMException">DOMException</span>
      <li><span class="dfn-paneled" id="term-for-idl-DOMString">DOMString</span>
+     <li><span class="dfn-paneled" id="term-for-encodingerror">EncodingError</span>
      <li><span class="dfn-paneled" id="term-for-Exposed">Exposed</span>
      <li><span class="dfn-paneled" id="term-for-invalidstateerror">InvalidStateError</span>
      <li><span class="dfn-paneled" id="term-for-notallowederror">NotAllowedError</span>
@@ -9046,9 +10084,12 @@ <h3 class="no-num no-ref heading settled" id="index-defined-elsewhere"><span cla
      <li><span class="dfn-paneled" id="term-for-idl-USVString">USVString</span>
      <li><span class="dfn-paneled" id="term-for-unknownerror">UnknownError</span>
      <li><span class="dfn-paneled" id="term-for-idl-boolean">boolean</span>
+     <li><span class="dfn-paneled" id="term-for-dfn-buffer-source-type">buffer source types</span>
      <li><span class="dfn-paneled" id="term-for-dfn-get-buffer-source-reference">get a copy of the bytes held by the buffer source</span>
      <li><span class="dfn-paneled" id="term-for-dfn-interface-object">interface object</span>
+     <li><span class="dfn-paneled" id="term-for-dfn-json-types">json type</span>
      <li><span class="dfn-paneled" id="term-for-idl-long">long</span>
+     <li><span class="dfn-paneled" id="term-for-idl-record">record</span>
      <li><span class="dfn-paneled" id="term-for-idl-sequence">sequence</span>
      <li><span class="dfn-paneled" id="term-for-idl-unsigned-long">unsigned long</span>
     </ul>
@@ -9067,7 +10108,9 @@ <h2 class="no-num no-ref heading settled" id="references"><span class="content">
   <h3 class="no-num no-ref heading settled" id="normative"><span class="content">Normative References</span><a class="self-link" href="#normative"></a></h3>
   <dl>
    <dt id="biblio-credential-management-1">[CREDENTIAL-MANAGEMENT-1]
-   <dd>Mike West. <a href="https://www.w3.org/TR/credential-management-1/"><cite>Credential Management Level 1</cite></a>. 17 January 2019. WD. URL: <a href="https://www.w3.org/TR/credential-management-1/">https://www.w3.org/TR/credential-management-1/</a>
+   <dd>Mike West. <a href="https://w3c.github.io/webappsec-credential-management/"><cite>Credential Management Level 1</cite></a>. URL: <a href="https://w3c.github.io/webappsec-credential-management/">https://w3c.github.io/webappsec-credential-management/</a>
+   <dt id="biblio-csp2">[CSP2]
+   <dd>Mike West; Adam Barth; Daniel Veditz. <a href="https://w3c.github.io/webappsec-csp/"><cite>Content Security Policy Level 2</cite></a>. URL: <a href="https://w3c.github.io/webappsec-csp/">https://w3c.github.io/webappsec-csp/</a>
    <dt id="biblio-dom4">[DOM4]
    <dd>Anne van Kesteren. <a href="https://dom.spec.whatwg.org/"><cite>DOM Standard</cite></a>. Living Standard. URL: <a href="https://dom.spec.whatwg.org/">https://dom.spec.whatwg.org/</a>
    <dt id="biblio-dom4①">[DOM4]
@@ -9089,7 +10132,7 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-fido-u2f-message-formats">[FIDO-U2F-Message-Formats]
    <dd>D. Balfanz; J. Ehrensvard; J. Lang. <a href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html"><cite>FIDO U2F Raw Message Formats</cite></a>. FIDO Alliance Implementation Draft. URL: <a href="https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html">https://fidoalliance.org/specs/fido-u2f-v1.1-id-20160915/fido-u2f-raw-message-formats-v1.1-id-20160915.html</a>
    <dt id="biblio-fileapi">[FileAPI]
-   <dd>Marijn Kruisselbrink; Arun Ranganathan. <a href="https://www.w3.org/TR/FileAPI/"><cite>File API</cite></a>. 4 June 2021. WD. URL: <a href="https://www.w3.org/TR/FileAPI/">https://www.w3.org/TR/FileAPI/</a>
+   <dd>Marijn Kruisselbrink; Arun Ranganathan. <a href="https://w3c.github.io/FileAPI/"><cite>File API</cite></a>. URL: <a href="https://w3c.github.io/FileAPI/">https://w3c.github.io/FileAPI/</a>
    <dt id="biblio-html">[HTML]
    <dd>Anne van Kesteren; et al. <a href="https://html.spec.whatwg.org/multipage/"><cite>HTML Standard</cite></a>. Living Standard. URL: <a href="https://html.spec.whatwg.org/multipage/">https://html.spec.whatwg.org/multipage/</a>
    <dt id="biblio-iana-cose-algs-reg">[IANA-COSE-ALGS-REG]
@@ -9101,7 +10144,7 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-page-visibility">[PAGE-VISIBILITY]
    <dd>Jatinder Mann; Arvind Jain. <a href="https://www.w3.org/TR/page-visibility/"><cite>Page Visibility (Second Edition)</cite></a>. 29 October 2013. REC. URL: <a href="https://www.w3.org/TR/page-visibility/">https://www.w3.org/TR/page-visibility/</a>
    <dt id="biblio-permissions-policy">[Permissions-Policy]
-   <dd>Ian Clelland. <a href="https://www.w3.org/TR/permissions-policy-1/"><cite>Permissions Policy</cite></a>. 16 July 2020. WD. URL: <a href="https://www.w3.org/TR/permissions-policy-1/">https://www.w3.org/TR/permissions-policy-1/</a>
+   <dd>Ian Clelland. <a href="https://w3c.github.io/webappsec-permissions-policy/"><cite>Permissions Policy</cite></a>. URL: <a href="https://w3c.github.io/webappsec-permissions-policy/">https://w3c.github.io/webappsec-permissions-policy/</a>
    <dt id="biblio-rfc2119">[RFC2119]
    <dd>S. Bradner. <a href="https://datatracker.ietf.org/doc/html/rfc2119"><cite>Key words for use in RFCs to Indicate Requirement Levels</cite></a>. March 1997. Best Current Practice. URL: <a href="https://datatracker.ietf.org/doc/html/rfc2119">https://datatracker.ietf.org/doc/html/rfc2119</a>
    <dt id="biblio-rfc3986">[RFC3986]
@@ -9159,11 +10202,11 @@ <h3 class="no-num no-ref heading settled" id="normative"><span class="content">N
    <dt id="biblio-utr29">[UTR29]
    <dd><a href="http://www.unicode.org/reports/tr29/"><cite>UNICODE Text Segmentation</cite></a>. URL: <a href="http://www.unicode.org/reports/tr29/">http://www.unicode.org/reports/tr29/</a>
    <dt id="biblio-wcag21">[WCAG21]
-   <dd>Andrew Kirkpatrick; et al. <a href="https://www.w3.org/TR/WCAG21/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. 5 June 2018. REC. URL: <a href="https://www.w3.org/TR/WCAG21/">https://www.w3.org/TR/WCAG21/</a>
+   <dd>Andrew Kirkpatrick; et al. <a href="https://w3c.github.io/wcag/21/guidelines/"><cite>Web Content Accessibility Guidelines (WCAG) 2.1</cite></a>. URL: <a href="https://w3c.github.io/wcag/21/guidelines/">https://w3c.github.io/wcag/21/guidelines/</a>
    <dt id="biblio-webauthn-1">[WebAuthn-1]
-   <dd>Dirk Balfanz; et al. <a href="https://www.w3.org/TR/webauthn-1/"><cite>Web Authentication:An API for accessing Public Key Credentials Level 1</cite></a>. 4 March 2019. REC. URL: <a href="https://www.w3.org/TR/webauthn-1/">https://www.w3.org/TR/webauthn-1/</a>
+   <dd>Dirk Balfanz; et al. <a href="https://w3c.github.io/webauthn/"><cite>Web Authentication:An API for accessing Public Key Credentials Level 1</cite></a>. URL: <a href="https://w3c.github.io/webauthn/">https://w3c.github.io/webauthn/</a>
    <dt id="biblio-webdriver">[WebDriver]
-   <dd>Simon Stewart; David Burns. <a href="https://www.w3.org/TR/webdriver1/"><cite>WebDriver</cite></a>. 5 June 2018. REC. URL: <a href="https://www.w3.org/TR/webdriver1/">https://www.w3.org/TR/webdriver1/</a>
+   <dd>Simon Stewart; David Burns. <a href="https://w3c.github.io/webdriver/"><cite>WebDriver</cite></a>. URL: <a href="https://w3c.github.io/webdriver/">https://w3c.github.io/webdriver/</a>
    <dt id="biblio-webidl">[WebIDL]
    <dd>Edgar Chen; Timothy Gu. <a href="https://webidl.spec.whatwg.org/"><cite>Web IDL Standard</cite></a>. Living Standard. URL: <a href="https://webidl.spec.whatwg.org/">https://webidl.spec.whatwg.org/</a>
   </dl>
@@ -9172,7 +10215,7 @@ <h3 class="no-num no-ref heading settled" id="informative"><span class="content"
    <dt id="biblio-ceremony">[Ceremony]
    <dd>Carl Ellison. <a href="https://eprint.iacr.org/2007/399.pdf"><cite>Ceremony Design and Analysis</cite></a>. 2007. URL: <a href="https://eprint.iacr.org/2007/399.pdf">https://eprint.iacr.org/2007/399.pdf</a>
    <dt id="biblio-css-overflow-3">[CSS-OVERFLOW-3]
-   <dd>David Baron; Elika Etemad; Florian Rivoal. <a href="https://www.w3.org/TR/css-overflow-3/"><cite>CSS Overflow Module Level 3</cite></a>. 23 December 2021. WD. URL: <a href="https://www.w3.org/TR/css-overflow-3/">https://www.w3.org/TR/css-overflow-3/</a>
+   <dd>David Baron; Elika Etemad; Florian Rivoal. <a href="https://drafts.csswg.org/css-overflow-3/"><cite>CSS Overflow Module Level 3</cite></a>. URL: <a href="https://drafts.csswg.org/css-overflow-3/">https://drafts.csswg.org/css-overflow-3/</a>
    <dt id="biblio-edupersonobjectclassspec">[EduPersonObjectClassSpec]
    <dd><a href="https://refeds.org/eduperson"><cite>EduPerson</cite></a>. ongoing. URL: <a href="https://refeds.org/eduperson">https://refeds.org/eduperson</a>
    <dt id="biblio-fido-transports-ext">[FIDO-Transports-Ext]
@@ -9209,6 +10252,45 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a data-link-type="idl-name" href="#authenticatorresponse"><c- n>AuthenticatorResponse</c-></a>    <a class="idl-code" data-link-type="attribute" data-readonly data-type="AuthenticatorResponse" href="#dom-publickeycredential-response"><c- g>response</c-></a>;
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>?               <a class="idl-code" data-link-type="attribute" data-readonly data-type="DOMString?" href="#dom-publickeycredential-authenticatorattachment"><c- g>authenticatorAttachment</c-></a>;
     <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputs"><c- n>AuthenticationExtensionsClientOutputs</c-></a> <a href="#dom-publickeycredential-getclientextensionresults"><code><c- g>getClientExtensionResults</c-></code></a>();
+    <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>> <a href="#dom-publickeycredential-isconditionalmediationavailable"><code><c- g>isConditionalMediationAvailable</c-></code></a>();
+    <a data-link-type="idl-name" href="#typedefdef-publickeycredentialjson"><c- n>PublicKeyCredentialJSON</c-></a> <a href="#dom-publickeycredential-tojson"><code><c- g>toJSON</c-></code></a>();
+};
+
+<c- b>typedef</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a href="#typedefdef-base64urlstring"><code><c- g>Base64URLString</c-></code></a>;
+<c- b>typedef</c-> (<a data-link-type="idl-name" href="#dictdef-registrationresponsejson"><c- n>RegistrationResponseJSON</c-></a> <c- b>or</c-> <a data-link-type="idl-name" href="#dictdef-authenticationresponsejson"><c- n>AuthenticationResponseJSON</c-></a>) <a href="#typedefdef-publickeycredentialjson"><code><c- g>PublicKeyCredentialJSON</c-></code></a>;
+
+<c- b>dictionary</c-> <a href="#dictdef-registrationresponsejson"><code><c- g>RegistrationResponseJSON</c-></code></a> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-registrationresponsejson-id"><code><c- g>id</c-></code></a>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-registrationresponsejson-rawid"><code><c- g>rawId</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticatorattestationresponsejson"><c- n>AuthenticatorAttestationResponseJSON</c-></a> <a data-type="AuthenticatorAttestationResponseJSON " href="#dom-registrationresponsejson-response"><code><c- g>response</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>?  <a data-type="DOMString?  " href="#dom-registrationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputsjson"><c- n>AuthenticationExtensionsClientOutputsJSON</c-></a> <a data-type="AuthenticationExtensionsClientOutputsJSON " href="#dom-registrationresponsejson-clientextensionresults"><code><c- g>clientExtensionResults</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString " href="#dom-registrationresponsejson-type"><code><c- g>type</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticatorattestationresponsejson"><code><c- g>AuthenticatorAttestationResponseJSON</c-></code></a> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticatorattestationresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code></a>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticatorattestationresponsejson-attestationobject"><code><c- g>attestationObject</c-></code></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>> <a data-type="sequence<DOMString> " href="#dom-authenticatorattestationresponsejson-transports"><code><c- g>transports</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticationresponsejson"><code><c- g>AuthenticationResponseJSON</c-></code></a> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticationresponsejson-id"><code><c- g>id</c-></code></a>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticationresponsejson-rawid"><code><c- g>rawId</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticatorassertionresponsejson"><c- n>AuthenticatorAssertionResponseJSON</c-></a> <a data-type="AuthenticatorAssertionResponseJSON " href="#dom-authenticationresponsejson-response"><code><c- g>response</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>?  <a data-type="DOMString?  " href="#dom-authenticationresponsejson-authenticatorattachment"><code><c- g>authenticatorAttachment</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientoutputsjson"><c- n>AuthenticationExtensionsClientOutputsJSON</c-></a> <a data-type="AuthenticationExtensionsClientOutputsJSON " href="#dom-authenticationresponsejson-clientextensionresults"><code><c- g>clientExtensionResults</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a> <a data-type="DOMString " href="#dom-authenticationresponsejson-type"><code><c- g>type</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticatorassertionresponsejson"><code><c- g>AuthenticatorAssertionResponseJSON</c-></code></a> {
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticatorassertionresponsejson-clientdatajson"><code><c- g>clientDataJSON</c-></code></a>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticatorassertionresponsejson-authenticatordata"><code><c- g>authenticatorData</c-></code></a>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a> <a data-type="Base64URLString " href="#dom-authenticatorassertionresponsejson-signature"><code><c- g>signature</c-></code></a>;
+    <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>? <a data-type="Base64URLString? " href="#dom-authenticatorassertionresponsejson-userhandle"><code><c- g>userHandle</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsclientoutputsjson"><code><c- g>AuthenticationExtensionsClientOutputsJSON</c-></code></a> {
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="https://w3c.github.io/webappsec-credential-management/#dictdef-credentialcreationoptions"><c- g>CredentialCreationOptions</c-></a> {
@@ -9223,6 +10305,50 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <c- b>static</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-promise"><c- b>Promise</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>> <a href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable"><code><c- g>isUserVerifyingPlatformAuthenticatorAvailable</c-></code></a>();
 };
 
+<c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptions"><c- n>PublicKeyCredentialCreationOptions</c-></a> <a href="#dom-publickeycredential-parsecreationoptionsfromjson"><code><c- g>parseCreationOptionsFromJSON</c-></code></a>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialcreationoptionsjson"><c- n>PublicKeyCredentialCreationOptionsJSON</c-></a> <a href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options"><code><c- g>options</c-></code></a>);
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-publickeycredentialcreationoptionsjson"><code><c- g>PublicKeyCredentialCreationOptionsJSON</c-></code></a> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrpentity"><c- n>PublicKeyCredentialRpEntity</c-></a>                    <a data-type="PublicKeyCredentialRpEntity                    " href="#dom-publickeycredentialcreationoptionsjson-rp"><code><c- g>rp</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialuserentityjson"><c- n>PublicKeyCredentialUserEntityJSON</c-></a>              <a data-type="PublicKeyCredentialUserEntityJSON              " href="#dom-publickeycredentialcreationoptionsjson-user"><code><c- g>user</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>                                <a data-type="Base64URLString                                " href="#dom-publickeycredentialcreationoptionsjson-challenge"><code><c- g>challenge</c-></code></a>;
+    <c- b>required</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialparameters"><c- n>PublicKeyCredentialParameters</c-></a>>        <a data-type="sequence<PublicKeyCredentialParameters>        " href="#dom-publickeycredentialcreationoptionsjson-pubkeycredparams"><code><c- g>pubKeyCredParams</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                                           <a data-type="unsigned long                                           " href="#dom-publickeycredentialcreationoptionsjson-timeout"><code><c- g>timeout</c-></code></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptorjson"><c- n>PublicKeyCredentialDescriptorJSON</c-></a>>             <a data-default="[]" data-type="sequence<PublicKeyCredentialDescriptorJSON>             " href="#dom-publickeycredentialcreationoptionsjson-excludecredentials"><code><c- g>excludeCredentials</c-></code></a> = [];
+    <a data-link-type="idl-name" href="#dictdef-authenticatorselectioncriteria"><c- n>AuthenticatorSelectionCriteria</c-></a>                          <a data-type="AuthenticatorSelectionCriteria                          " href="#dom-publickeycredentialcreationoptionsjson-authenticatorselection"><code><c- g>authenticatorSelection</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                                               <a data-default="&quot;none&quot;" data-type="DOMString                                               " href="#dom-publickeycredentialcreationoptionsjson-attestation"><code><c- g>attestation</c-></code></a> = "none";
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <a data-type="AuthenticationExtensionsClientInputsJSON                " href="#dom-publickeycredentialcreationoptionsjson-extensions"><code><c- g>extensions</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-publickeycredentialuserentityjson"><code><c- g>PublicKeyCredentialUserEntityJSON</c-></code></a> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>        <a data-type="Base64URLString        " href="#dom-publickeycredentialuserentityjson-id"><code><c- g>id</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>              <a data-type="DOMString              " href="#dom-publickeycredentialuserentityjson-name"><code><c- g>name</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>              <a data-type="DOMString              " href="#dom-publickeycredentialuserentityjson-displayname"><code><c- g>displayName</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-publickeycredentialdescriptorjson"><code><c- g>PublicKeyCredentialDescriptorJSON</c-></code></a> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>        <a data-type="Base64URLString        " href="#dom-publickeycredentialdescriptorjson-id"><code><c- g>id</c-></code></a>;
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>              <a data-type="DOMString              " href="#dom-publickeycredentialdescriptorjson-type"><code><c- g>type</c-></code></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>>             <a data-type="sequence<DOMString>             " href="#dom-publickeycredentialdescriptorjson-transports"><code><c- g>transports</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsclientinputsjson"><code><c- g>AuthenticationExtensionsClientInputsJSON</c-></code></a> {
+};
+
+<c- b>partial</c-> <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#publickeycredential"><c- g>PublicKeyCredential</c-></a> {
+    <c- b>static</c-> <a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptions"><c- n>PublicKeyCredentialRequestOptions</c-></a> <a href="#dom-publickeycredential-parserequestoptionsfromjson"><code><c- g>parseRequestOptionsFromJSON</c-></code></a>(<a data-link-type="idl-name" href="#dictdef-publickeycredentialrequestoptionsjson"><c- n>PublicKeyCredentialRequestOptionsJSON</c-></a> <a href="#dom-publickeycredential-parserequestoptionsfromjson-options-options"><code><c- g>options</c-></code></a>);
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-publickeycredentialrequestoptionsjson"><code><c- g>PublicKeyCredentialRequestOptionsJSON</c-></code></a> {
+    <c- b>required</c-> <a data-link-type="idl-name" href="#typedefdef-base64urlstring"><c- n>Base64URLString</c-></a>                                <a data-type="Base64URLString                                " href="#dom-publickeycredentialrequestoptionsjson-challenge"><code><c- g>challenge</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>                                           <a data-type="unsigned long                                           " href="#dom-publickeycredentialrequestoptionsjson-timeout"><code><c- g>timeout</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                                               <a data-type="DOMString                                               " href="#dom-publickeycredentialrequestoptionsjson-rpid"><code><c- g>rpId</c-></code></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#dictdef-publickeycredentialdescriptorjson"><c- n>PublicKeyCredentialDescriptorJSON</c-></a>>             <a data-default="[]" data-type="sequence<PublicKeyCredentialDescriptorJSON>             " href="#dom-publickeycredentialrequestoptionsjson-allowcredentials"><code><c- g>allowCredentials</c-></code></a> = [];
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>                                               <a data-default="&quot;preferred&quot;" data-type="DOMString                                               " href="#dom-publickeycredentialrequestoptionsjson-userverification"><code><c- g>userVerification</c-></code></a> = "preferred";
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsclientinputsjson"><c- n>AuthenticationExtensionsClientInputsJSON</c-></a>                <a data-type="AuthenticationExtensionsClientInputsJSON                " href="#dom-publickeycredentialrequestoptionsjson-extensions"><code><c- g>extensions</c-></code></a>;
+};
+
 [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SecureContext"><c- g>SecureContext</c-></a>, <a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#Exposed"><c- g>Exposed</c-></a>=<c- n>Window</c->]
 <c- b>interface</c-> <a class="idl-code" data-link-type="interface" href="#authenticatorresponse"><c- g>AuthenticatorResponse</c-></a> {
     [<a class="idl-code" data-link-type="extended-attribute" href="https://webidl.spec.whatwg.org/#SameObject"><c- g>SameObject</c-></a>] <c- b>readonly</c-> <c- b>attribute</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a>      <a class="idl-code" data-link-type="attribute" data-readonly data-type="ArrayBuffer" href="#dom-authenticatorresponse-clientdatajson"><c- g>clientDataJSON</c-></a>;
@@ -9320,7 +10446,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-type"><c- g>type</c-></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-challenge"><c- g>challenge</c-></a>;
     <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-DOMString"><c- b>DOMString</c-></a>           <a class="idl-code" data-link-type="dict-member" data-type="DOMString           " href="#dom-collectedclientdata-origin"><c- g>origin</c-></a>;
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean                      " href="#dom-collectedclientdata-crossorigin"><c- g>crossOrigin</c-></a>;        
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a>                      <a class="idl-code" data-link-type="dict-member" data-type="boolean                      " href="#dom-collectedclientdata-crossorigin"><c- g>crossOrigin</c-></a>;
 };
 
 <c- b>dictionary</c-> <a href="#dictdef-tokenbinding"><code><c- g>TokenBinding</c-></code></a> {
@@ -9344,6 +10470,7 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-usb"><c- s>"usb"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-nfc"><c- s>"nfc"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-ble"><c- s>"ble"</c-></a>,
+    <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-hybrid"><c- s>"hybrid"</c-></a>,
     <a class="idl-code" data-link-type="enum-value" href="#dom-authenticatortransport-internal"><c- s>"internal"</c-></a>
 };
 
@@ -9372,26 +10499,38 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a data-type="boolean " href="#dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a data-type="boolean " href="#dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code></a>;
 };
 
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>> <a href="#typedefdef-uvmentry"><code><c- g>UvmEntry</c-></code></a>;
-<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-uvmentry"><c- n>UvmEntry</c-></a>> <a href="#typedefdef-uvmentries"><code><c- g>UvmEntries</c-></code></a>;
+<c- b>dictionary</c-> <a href="#dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></a> {
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk"><c- g>rk</c-></a>;
+};
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-  <a data-link-type="idl-name" href="#typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <a data-type="UvmEntries " href="#dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-credentialpropertiesoutput"><c- n>CredentialPropertiesOutput</c-></a> <a data-type="CredentialPropertiesOutput " href="#dom-authenticationextensionsclientoutputs-credprops"><code><c- g>credProps</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsprfvalues"><code><c- g>AuthenticationExtensionsPRFValues</c-></code></a> {
+    <c- b>required</c-> <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a> <a data-type="ArrayBuffer " href="#dom-authenticationextensionsprfvalues-first"><code><c- g>first</c-></code></a>;
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-ArrayBuffer"><c- b>ArrayBuffer</c-></a> <a data-type="ArrayBuffer " href="#dom-authenticationextensionsprfvalues-second"><code><c- g>second</c-></code></a>;
+};
+
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsprfinputs"><code><c- g>AuthenticationExtensionsPRFInputs</c-></code></a> {
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues " href="#dom-authenticationextensionsprfinputs-eval"><c- g>eval</c-></a>;
+    <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-record"><c- b>record</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-USVString"><c- b>USVString</c-></a>, <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a>> <a class="idl-code" data-link-type="dict-member" data-type="record<USVString, AuthenticationExtensionsPRFValues> " href="#dom-authenticationextensionsprfinputs-evalbycredential"><c- g>evalByCredential</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a data-type="boolean " href="#dom-authenticationextensionsclientinputs-credprops"><code><c- g>credProps</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfinputs"><c- n>AuthenticationExtensionsPRFInputs</c-></a> <a data-type="AuthenticationExtensionsPRFInputs " href="#dom-authenticationextensionsclientinputs-prf"><code><c- g>prf</c-></code></a>;
 };
 
-<c- b>dictionary</c-> <a href="#dictdef-credentialpropertiesoutput"><code><c- g>CredentialPropertiesOutput</c-></code></a> {
-    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-credentialpropertiesoutput-rk"><c- g>rk</c-></a>;
+<c- b>dictionary</c-> <a href="#dictdef-authenticationextensionsprfoutputs"><code><c- g>AuthenticationExtensionsPRFOutputs</c-></code></a> {
+    <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionsprfoutputs-enabled"><c- g>enabled</c-></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfvalues"><c- n>AuthenticationExtensionsPRFValues</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="AuthenticationExtensionsPRFValues " href="#dom-authenticationextensionsprfoutputs-results"><c- g>results</c-></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
-    <a data-link-type="idl-name" href="#dictdef-credentialpropertiesoutput"><c- n>CredentialPropertiesOutput</c-></a> <a data-type="CredentialPropertiesOutput " href="#dom-authenticationextensionsclientoutputs-credprops"><code><c- g>credProps</c-></code></a>;
+    <a data-link-type="idl-name" href="#dictdef-authenticationextensionsprfoutputs"><c- n>AuthenticationExtensionsPRFOutputs</c-></a> <a data-type="AuthenticationExtensionsPRFOutputs " href="#dom-authenticationextensionsclientoutputs-prf"><code><c- g>prf</c-></code></a>;
 };
 
 <c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
@@ -9419,6 +10558,17 @@ <h2 class="no-num no-ref heading settled" id="idl-index"><span class="content">I
     <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a class="idl-code" data-link-type="dict-member" data-type="boolean " href="#dom-authenticationextensionslargebloboutputs-written"><c- g>written</c-></a>;
 };
 
+<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientinputs"><c- g>AuthenticationExtensionsClientInputs</c-></a> {
+  <a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-boolean"><c- b>boolean</c-></a> <a data-type="boolean " href="#dom-authenticationextensionsclientinputs-uvm"><code><c- g>uvm</c-></code></a>;
+};
+
+<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a class="idl-code" data-link-type="interface" href="https://webidl.spec.whatwg.org/#idl-unsigned-long"><c- b>unsigned</c-> <c- b>long</c-></a>> <a href="#typedefdef-uvmentry"><code><c- g>UvmEntry</c-></code></a>;
+<c- b>typedef</c-> <a data-link-type="dfn" href="https://webidl.spec.whatwg.org/#idl-sequence"><c- b>sequence</c-></a>&lt;<a data-link-type="idl-name" href="#typedefdef-uvmentry"><c- n>UvmEntry</c-></a>> <a href="#typedefdef-uvmentries"><code><c- g>UvmEntries</c-></code></a>;
+
+<c- b>partial</c-> <c- b>dictionary</c-> <a class="idl-code" data-link-type="dictionary" href="#dictdef-authenticationextensionsclientoutputs"><c- g>AuthenticationExtensionsClientOutputs</c-></a> {
+  <a data-link-type="idl-name" href="#typedefdef-uvmentries"><c- n>UvmEntries</c-></a> <a data-type="UvmEntries " href="#dom-authenticationextensionsclientoutputs-uvm"><code><c- g>uvm</c-></code></a>;
+};
+
 </pre>
   <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content">Issues Index</span><a class="self-link" href="#issues-index"></a></h2>
   <div style="counter-reset:issue">
@@ -9429,16 +10579,19 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="base64url-encoding">
    <b><a href="#base64url-encoding">#base64url-encoding</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-base64url-encoding">5.1. PublicKeyCredential Interface</a>
-    <li><a href="#ref-for-base64url-encoding①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-base64url-encoding②">(2)</a>
-    <li><a href="#ref-for-base64url-encoding③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-base64url-encoding④">(2)</a>
-    <li><a href="#ref-for-base64url-encoding⑤">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
-    <li><a href="#ref-for-base64url-encoding⑥">5.8.1.1. Serialization</a>
-    <li><a href="#ref-for-base64url-encoding⑦">5.8.1.2. Limited Verification Algorithm</a>
-    <li><a href="#ref-for-base64url-encoding⑧">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-base64url-encoding⑨">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-base64url-encoding①⓪">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-base64url-encoding①①">11.5. Add Credential</a> <a href="#ref-for-base64url-encoding①②">(2)</a> <a href="#ref-for-base64url-encoding①③">(3)</a> <a href="#ref-for-base64url-encoding①④">(4)</a> <a href="#ref-for-base64url-encoding①⑤">(5)</a> <a href="#ref-for-base64url-encoding①⑥">(6)</a> <a href="#ref-for-base64url-encoding①⑦">(7)</a> <a href="#ref-for-base64url-encoding①⑧">(8)</a>
+    <li><a href="#ref-for-base64url-encoding">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-base64url-encoding①">(2)</a> <a href="#ref-for-base64url-encoding②">(3)</a>
+    <li><a href="#ref-for-base64url-encoding③">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-base64url-encoding④">(2)</a>
+    <li><a href="#ref-for-base64url-encoding⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-base64url-encoding⑥">(2)</a>
+    <li><a href="#ref-for-base64url-encoding⑦">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-base64url-encoding⑧">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-base64url-encoding⑨">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-base64url-encoding①⓪">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
+    <li><a href="#ref-for-base64url-encoding①①">5.8.1.1. Serialization</a>
+    <li><a href="#ref-for-base64url-encoding①②">5.8.1.2. Limited Verification Algorithm</a>
+    <li><a href="#ref-for-base64url-encoding①③">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-base64url-encoding①④">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-base64url-encoding①⑤">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-base64url-encoding①⑥">(2)</a>
+    <li><a href="#ref-for-base64url-encoding①⑦">11.5. Add Credential</a> <a href="#ref-for-base64url-encoding①⑧">(2)</a> <a href="#ref-for-base64url-encoding①⑨">(3)</a> <a href="#ref-for-base64url-encoding②⓪">(4)</a> <a href="#ref-for-base64url-encoding②①">(5)</a> <a href="#ref-for-base64url-encoding②②">(6)</a> <a href="#ref-for-base64url-encoding②③">(7)</a> <a href="#ref-for-base64url-encoding②④">(8)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="cbor">
@@ -9535,35 +10688,36 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authentication③">4. Terminology</a> <a href="#ref-for-authentication④">(2)</a> <a href="#ref-for-authentication⑤">(3)</a> <a href="#ref-for-authentication⑥">(4)</a> <a href="#ref-for-authentication⑦">(5)</a> <a href="#ref-for-authentication⑧">(6)</a> <a href="#ref-for-authentication⑨">(7)</a>
     <li><a href="#ref-for-authentication①⓪">5. Web Authentication API</a>
     <li><a href="#ref-for-authentication①①">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-authentication①②">(2)</a>
-    <li><a href="#ref-for-authentication①③">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-authentication①④">13. Security Considerations</a>
-    <li><a href="#ref-for-authentication①⑤">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
-    <li><a href="#ref-for-authentication①⑥">14.3. Authenticator-local Biometric Recognition</a>
-    <li><a href="#ref-for-authentication①⑦">14.6.2. Username Enumeration</a>
-    <li><a href="#ref-for-authentication①⑧">16. Acknowledgements</a>
+    <li><a href="#ref-for-authentication①③">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-authentication①④">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-authentication①⑤">13. Security Considerations</a>
+    <li><a href="#ref-for-authentication①⑥">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
+    <li><a href="#ref-for-authentication①⑦">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-authentication①⑧">14.6.2. Username Enumeration</a>
+    <li><a href="#ref-for-authentication①⑨">16. Acknowledgements</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authentication-ceremony">
    <b><a href="#authentication-ceremony">#authentication-ceremony</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-authentication-ceremony">4. Terminology</a> <a href="#ref-for-authentication-ceremony①">(2)</a> <a href="#ref-for-authentication-ceremony②">(3)</a> <a href="#ref-for-authentication-ceremony③">(4)</a> <a href="#ref-for-authentication-ceremony④">(5)</a> <a href="#ref-for-authentication-ceremony⑤">(6)</a> <a href="#ref-for-authentication-ceremony⑥">(7)</a>
-    <li><a href="#ref-for-authentication-ceremony⑦">5.1. PublicKeyCredential Interface</a>
-    <li><a href="#ref-for-authentication-ceremony⑧">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-authentication-ceremony⑨">(2)</a> <a href="#ref-for-authentication-ceremony①⓪">(3)</a>
-    <li><a href="#ref-for-authentication-ceremony①①">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
-    <li><a href="#ref-for-authentication-ceremony①②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-authentication-ceremony①③">(2)</a> <a href="#ref-for-authentication-ceremony①④">(3)</a>
-    <li><a href="#ref-for-authentication-ceremony①⑤">6.2.1. Authenticator Attachment Modality</a>
-    <li><a href="#ref-for-authentication-ceremony①⑥">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-authentication-ceremony①⑦">(2)</a>
-    <li><a href="#ref-for-authentication-ceremony①⑧">7. WebAuthn Relying Party Operations</a>
-    <li><a href="#ref-for-authentication-ceremony①⑨">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-authentication-ceremony②⓪">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-authentication-ceremony②①">(2)</a> <a href="#ref-for-authentication-ceremony②②">(3)</a> <a href="#ref-for-authentication-ceremony②③">(4)</a> <a href="#ref-for-authentication-ceremony②④">(5)</a> <a href="#ref-for-authentication-ceremony②⑤">(6)</a>
-    <li><a href="#ref-for-authentication-ceremony②⑥">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
-    <li><a href="#ref-for-authentication-ceremony②⑦">13.4.4. Attestation Limitations</a> <a href="#ref-for-authentication-ceremony②⑧">(2)</a>
-    <li><a href="#ref-for-authentication-ceremony②⑨">13.4.7. Unprotected account detection</a> <a href="#ref-for-authentication-ceremony③⓪">(2)</a>
-    <li><a href="#ref-for-authentication-ceremony③①">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
-    <li><a href="#ref-for-authentication-ceremony③②">14.5.2. Authentication Ceremony Privacy</a>
-    <li><a href="#ref-for-authentication-ceremony③③">14.6.2. Username Enumeration</a> <a href="#ref-for-authentication-ceremony③④">(2)</a> <a href="#ref-for-authentication-ceremony③⑤">(3)</a> <a href="#ref-for-authentication-ceremony③⑥">(4)</a> <a href="#ref-for-authentication-ceremony③⑦">(5)</a>
-    <li><a href="#ref-for-authentication-ceremony③⑧">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-authentication-ceremony③⑨">(2)</a>
-    <li><a href="#ref-for-authentication-ceremony④⓪">15. Accessibility Considerations</a>
+    <li><a href="#ref-for-authentication-ceremony">4. Terminology</a> <a href="#ref-for-authentication-ceremony①">(2)</a> <a href="#ref-for-authentication-ceremony②">(3)</a> <a href="#ref-for-authentication-ceremony③">(4)</a> <a href="#ref-for-authentication-ceremony④">(5)</a> <a href="#ref-for-authentication-ceremony⑤">(6)</a> <a href="#ref-for-authentication-ceremony⑥">(7)</a> <a href="#ref-for-authentication-ceremony⑦">(8)</a>
+    <li><a href="#ref-for-authentication-ceremony⑧">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-authentication-ceremony⑨">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-authentication-ceremony①⓪">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-authentication-ceremony①①">(2)</a> <a href="#ref-for-authentication-ceremony①②">(3)</a>
+    <li><a href="#ref-for-authentication-ceremony①③">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
+    <li><a href="#ref-for-authentication-ceremony①④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-authentication-ceremony①⑤">(2)</a> <a href="#ref-for-authentication-ceremony①⑥">(3)</a>
+    <li><a href="#ref-for-authentication-ceremony①⑦">6.2.1. Authenticator Attachment Modality</a>
+    <li><a href="#ref-for-authentication-ceremony①⑧">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-authentication-ceremony①⑨">(2)</a>
+    <li><a href="#ref-for-authentication-ceremony②⓪">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-authentication-ceremony②①">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-authentication-ceremony②②">(2)</a> <a href="#ref-for-authentication-ceremony②③">(3)</a> <a href="#ref-for-authentication-ceremony②④">(4)</a> <a href="#ref-for-authentication-ceremony②⑤">(5)</a> <a href="#ref-for-authentication-ceremony②⑥">(6)</a>
+    <li><a href="#ref-for-authentication-ceremony②⑦">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
+    <li><a href="#ref-for-authentication-ceremony②⑧">13.4.4. Attestation Limitations</a> <a href="#ref-for-authentication-ceremony②⑨">(2)</a>
+    <li><a href="#ref-for-authentication-ceremony③⓪">13.4.7. Unprotected account detection</a> <a href="#ref-for-authentication-ceremony③①">(2)</a>
+    <li><a href="#ref-for-authentication-ceremony③②">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
+    <li><a href="#ref-for-authentication-ceremony③③">14.5.2. Authentication Ceremony Privacy</a>
+    <li><a href="#ref-for-authentication-ceremony③④">14.6.2. Username Enumeration</a> <a href="#ref-for-authentication-ceremony③⑤">(2)</a> <a href="#ref-for-authentication-ceremony③⑥">(3)</a> <a href="#ref-for-authentication-ceremony③⑦">(4)</a> <a href="#ref-for-authentication-ceremony③⑧">(5)</a>
+    <li><a href="#ref-for-authentication-ceremony③⑨">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-authentication-ceremony④⓪">(2)</a>
+    <li><a href="#ref-for-authentication-ceremony④①">15. Accessibility Considerations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authentication-assertion">
@@ -9579,6 +10733,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authentication-assertion①③">9. WebAuthn Extensions</a>
     <li><a href="#ref-for-authentication-assertion①④">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-authentication-assertion①⑤">(2)</a>
     <li><a href="#ref-for-authentication-assertion①⑥">13.4.4. Attestation Limitations</a>
+    <li><a href="#ref-for-authentication-assertion①⑦">13.4.8. Code injection attacks</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="assertion">
@@ -9587,10 +10742,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-assertion">4. Terminology</a>
     <li><a href="#ref-for-assertion①">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
     <li><a href="#ref-for-assertion②">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-assertion③">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-assertion④">(2)</a>
-    <li><a href="#ref-for-assertion⑤">13.1. Credential ID Unsigned</a>
-    <li><a href="#ref-for-assertion⑥">13.4.7. Unprotected account detection</a>
-    <li><a href="#ref-for-assertion⑦">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-assertion③">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-assertion④">(2)</a>
+    <li><a href="#ref-for-assertion⑤">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-assertion⑥">(2)</a> <a href="#ref-for-assertion⑦">(3)</a> <a href="#ref-for-assertion⑧">(4)</a> <a href="#ref-for-assertion⑨">(5)</a> <a href="#ref-for-assertion①⓪">(6)</a> <a href="#ref-for-assertion①①">(7)</a>
+    <li><a href="#ref-for-assertion①②">13.1. Credential ID Unsigned</a>
+    <li><a href="#ref-for-assertion①③">13.4.7. Unprotected account detection</a>
+    <li><a href="#ref-for-assertion①④">14.3. Authenticator-local Biometric Recognition</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator">
@@ -9607,67 +10763,71 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authenticator⑥②">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-authenticator⑥③">(2)</a> <a href="#ref-for-authenticator⑥④">(3)</a>
     <li><a href="#ref-for-authenticator⑥⑤">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-authenticator⑥⑥">(2)</a> <a href="#ref-for-authenticator⑥⑦">(3)</a> <a href="#ref-for-authenticator⑥⑧">(4)</a> <a href="#ref-for-authenticator⑥⑨">(5)</a> <a href="#ref-for-authenticator⑦⓪">(6)</a> <a href="#ref-for-authenticator⑦①">(7)</a> <a href="#ref-for-authenticator⑦②">(8)</a> <a href="#ref-for-authenticator⑦③">(9)</a>
     <li><a href="#ref-for-authenticator⑦④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-authenticator⑦⑤">(2)</a> <a href="#ref-for-authenticator⑦⑥">(3)</a> <a href="#ref-for-authenticator⑦⑦">(4)</a> <a href="#ref-for-authenticator⑦⑧">(5)</a> <a href="#ref-for-authenticator⑦⑨">(6)</a> <a href="#ref-for-authenticator⑧⓪">(7)</a> <a href="#ref-for-authenticator⑧①">(8)</a>
-    <li><a href="#ref-for-authenticator⑧②">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
-    <li><a href="#ref-for-authenticator⑧③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-authenticator⑧④">(2)</a> <a href="#ref-for-authenticator⑧⑤">(3)</a>
-    <li><a href="#ref-for-authenticator⑧⑥">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-authenticator⑧⑦">(2)</a>
-    <li><a href="#ref-for-authenticator⑧⑧">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
-    <li><a href="#ref-for-authenticator⑧⑨">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-authenticator⑨⓪">(2)</a> <a href="#ref-for-authenticator⑨①">(3)</a> <a href="#ref-for-authenticator⑨②">(4)</a> <a href="#ref-for-authenticator⑨③">(5)</a> <a href="#ref-for-authenticator⑨④">(6)</a> <a href="#ref-for-authenticator⑨⑤">(7)</a> <a href="#ref-for-authenticator⑨⑥">(8)</a>
-    <li><a href="#ref-for-authenticator⑨⑦">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
-    <li><a href="#ref-for-authenticator⑨⑧">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-authenticator⑨⑨">(2)</a>
-    <li><a href="#ref-for-authenticator①⓪⓪">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
-    <li><a href="#ref-for-authenticator①⓪①">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
-    <li><a href="#ref-for-authenticator①⓪②">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-authenticator①⓪③">(2)</a> <a href="#ref-for-authenticator①⓪④">(3)</a>
-    <li><a href="#ref-for-authenticator①⓪⑤">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-authenticator①⓪⑥">(2)</a> <a href="#ref-for-authenticator①⓪⑦">(3)</a>
-    <li><a href="#ref-for-authenticator①⓪⑧">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-authenticator①⓪⑨">(2)</a> <a href="#ref-for-authenticator①①⓪">(3)</a> <a href="#ref-for-authenticator①①①">(4)</a> <a href="#ref-for-authenticator①①②">(5)</a> <a href="#ref-for-authenticator①①③">(6)</a>
-    <li><a href="#ref-for-authenticator①①④">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
-    <li><a href="#ref-for-authenticator①①⑤">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
-    <li><a href="#ref-for-authenticator①①⑥">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a> <a href="#ref-for-authenticator①①⑦">(2)</a> <a href="#ref-for-authenticator①①⑧">(3)</a> <a href="#ref-for-authenticator①①⑨">(4)</a> <a href="#ref-for-authenticator①②⓪">(5)</a>
-    <li><a href="#ref-for-authenticator①②①">6. WebAuthn Authenticator Model</a> <a href="#ref-for-authenticator①②②">(2)</a> <a href="#ref-for-authenticator①②③">(3)</a> <a href="#ref-for-authenticator①②④">(4)</a> <a href="#ref-for-authenticator①②⑤">(5)</a>
-    <li><a href="#ref-for-authenticator①②⑥">6.1. Authenticator Data</a> <a href="#ref-for-authenticator①②⑦">(2)</a>
-    <li><a href="#ref-for-authenticator①②⑧">6.1.3. Credential Backup State</a> <a href="#ref-for-authenticator①②⑨">(2)</a> <a href="#ref-for-authenticator①③⓪">(3)</a> <a href="#ref-for-authenticator①③①">(4)</a> <a href="#ref-for-authenticator①③②">(5)</a> <a href="#ref-for-authenticator①③③">(6)</a> <a href="#ref-for-authenticator①③④">(7)</a> <a href="#ref-for-authenticator①③⑤">(8)</a>
-    <li><a href="#ref-for-authenticator①③⑥">6.2. Authenticator Taxonomy</a> <a href="#ref-for-authenticator①③⑦">(2)</a> <a href="#ref-for-authenticator①③⑧">(3)</a> <a href="#ref-for-authenticator①③⑨">(4)</a> <a href="#ref-for-authenticator①④⓪">(5)</a> <a href="#ref-for-authenticator①④①">(6)</a>
-    <li><a href="#ref-for-authenticator①④②">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-authenticator①④③">(2)</a> <a href="#ref-for-authenticator①④④">(3)</a> <a href="#ref-for-authenticator①④⑤">(4)</a> <a href="#ref-for-authenticator①④⑥">(5)</a> <a href="#ref-for-authenticator①④⑦">(6)</a>
-    <li><a href="#ref-for-authenticator①④⑧">6.2.2. Credential Storage Modality</a> <a href="#ref-for-authenticator①④⑨">(2)</a> <a href="#ref-for-authenticator①⑤⓪">(3)</a> <a href="#ref-for-authenticator①⑤①">(4)</a> <a href="#ref-for-authenticator①⑤②">(5)</a> <a href="#ref-for-authenticator①⑤③">(6)</a> <a href="#ref-for-authenticator①⑤④">(7)</a> <a href="#ref-for-authenticator①⑤⑤">(8)</a> <a href="#ref-for-authenticator①⑤⑥">(9)</a> <a href="#ref-for-authenticator①⑤⑦">(10)</a> <a href="#ref-for-authenticator①⑤⑧">(11)</a> <a href="#ref-for-authenticator①⑤⑨">(12)</a> <a href="#ref-for-authenticator①⑥⓪">(13)</a> <a href="#ref-for-authenticator①⑥①">(14)</a> <a href="#ref-for-authenticator①⑥②">(15)</a>
-    <li><a href="#ref-for-authenticator①⑥③">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-authenticator①⑥④">(2)</a> <a href="#ref-for-authenticator①⑥⑤">(3)</a> <a href="#ref-for-authenticator①⑥⑥">(4)</a> <a href="#ref-for-authenticator①⑥⑦">(5)</a> <a href="#ref-for-authenticator①⑥⑧">(6)</a> <a href="#ref-for-authenticator①⑥⑨">(7)</a> <a href="#ref-for-authenticator①⑦⓪">(8)</a>
-    <li><a href="#ref-for-authenticator①⑦①">6.3.1. Lookup Credential Source by Credential ID Algorithm</a>
-    <li><a href="#ref-for-authenticator①⑦②">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-authenticator①⑦③">(2)</a> <a href="#ref-for-authenticator①⑦④">(3)</a> <a href="#ref-for-authenticator①⑦⑤">(4)</a> <a href="#ref-for-authenticator①⑦⑥">(5)</a> <a href="#ref-for-authenticator①⑦⑦">(6)</a>
-    <li><a href="#ref-for-authenticator①⑦⑧">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-authenticator①⑦⑨">(2)</a> <a href="#ref-for-authenticator①⑧⓪">(3)</a> <a href="#ref-for-authenticator①⑧①">(4)</a> <a href="#ref-for-authenticator①⑧②">(5)</a>
-    <li><a href="#ref-for-authenticator①⑧③">6.4.1. String Truncation</a> <a href="#ref-for-authenticator①⑧④">(2)</a>
-    <li><a href="#ref-for-authenticator①⑧⑤">6.4.2. Language and Direction Encoding</a>
-    <li><a href="#ref-for-authenticator①⑧⑥">6.5. Attestation</a> <a href="#ref-for-authenticator①⑧⑦">(2)</a> <a href="#ref-for-authenticator①⑧⑧">(3)</a> <a href="#ref-for-authenticator①⑧⑨">(4)</a> <a href="#ref-for-authenticator①⑨⓪">(5)</a> <a href="#ref-for-authenticator①⑨①">(6)</a> <a href="#ref-for-authenticator①⑨②">(7)</a> <a href="#ref-for-authenticator①⑨③">(8)</a> <a href="#ref-for-authenticator①⑨④">(9)</a> <a href="#ref-for-authenticator①⑨⑤">(10)</a> <a href="#ref-for-authenticator①⑨⑥">(11)</a> <a href="#ref-for-authenticator①⑨⑦">(12)</a>
-    <li><a href="#ref-for-authenticator①⑨⑧">6.5.2. Attestation Statement Formats</a>
-    <li><a href="#ref-for-authenticator①⑨⑨">6.5.3. Attestation Types</a> <a href="#ref-for-authenticator②⓪⓪">(2)</a> <a href="#ref-for-authenticator②⓪①">(3)</a> <a href="#ref-for-authenticator②⓪②">(4)</a> <a href="#ref-for-authenticator②⓪③">(5)</a> <a href="#ref-for-authenticator②⓪④">(6)</a>
-    <li><a href="#ref-for-authenticator②⓪⑤">6.5.4. Generating an Attestation Object</a>
-    <li><a href="#ref-for-authenticator②⓪⑥">6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures</a> <a href="#ref-for-authenticator②⓪⑦">(2)</a>
-    <li><a href="#ref-for-authenticator②⓪⑧">7.1. Registering a New Credential</a> <a href="#ref-for-authenticator②⓪⑨">(2)</a> <a href="#ref-for-authenticator②①⓪">(3)</a> <a href="#ref-for-authenticator②①①">(4)</a>
-    <li><a href="#ref-for-authenticator②①②">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-authenticator②①③">8.2. Packed Attestation Statement Format</a>
-    <li><a href="#ref-for-authenticator②①④">8.4. Android Key Attestation Statement Format</a>
-    <li><a href="#ref-for-authenticator②①⑤">8.5. Android SafetyNet Attestation Statement Format</a>
-    <li><a href="#ref-for-authenticator②①⑥">8.7. None Attestation Statement Format</a> <a href="#ref-for-authenticator②①⑦">(2)</a> <a href="#ref-for-authenticator②①⑧">(3)</a>
-    <li><a href="#ref-for-authenticator②①⑨">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-authenticator②②⓪">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-authenticator②②①">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-authenticator②②②">(2)</a> <a href="#ref-for-authenticator②②③">(3)</a> <a href="#ref-for-authenticator②②④">(4)</a>
-    <li><a href="#ref-for-authenticator②②⑤">13. Security Considerations</a> <a href="#ref-for-authenticator②②⑥">(2)</a> <a href="#ref-for-authenticator②②⑦">(3)</a> <a href="#ref-for-authenticator②②⑧">(4)</a>
-    <li><a href="#ref-for-authenticator②②⑨">13.1. Credential ID Unsigned</a>
-    <li><a href="#ref-for-authenticator②③⓪">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-authenticator②③①">(2)</a> <a href="#ref-for-authenticator②③②">(3)</a> <a href="#ref-for-authenticator②③③">(4)</a> <a href="#ref-for-authenticator②③④">(5)</a> <a href="#ref-for-authenticator②③⑤">(6)</a> <a href="#ref-for-authenticator②③⑥">(7)</a> <a href="#ref-for-authenticator②③⑦">(8)</a> <a href="#ref-for-authenticator②③⑧">(9)</a> <a href="#ref-for-authenticator②③⑨">(10)</a>
-    <li><a href="#ref-for-authenticator②④⓪">13.3. Security considerations for authenticators </a>
-    <li><a href="#ref-for-authenticator②④①">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a>
-    <li><a href="#ref-for-authenticator②④②">13.4.1. Security Benefits for WebAuthn Relying Parties</a> <a href="#ref-for-authenticator②④③">(2)</a> <a href="#ref-for-authenticator②④④">(3)</a> <a href="#ref-for-authenticator②④⑤">(4)</a> <a href="#ref-for-authenticator②④⑥">(5)</a> <a href="#ref-for-authenticator②④⑦">(6)</a>
-    <li><a href="#ref-for-authenticator②④⑧">13.4.4. Attestation Limitations</a> <a href="#ref-for-authenticator②④⑨">(2)</a> <a href="#ref-for-authenticator②⑤⓪">(3)</a> <a href="#ref-for-authenticator②⑤①">(4)</a> <a href="#ref-for-authenticator②⑤②">(5)</a> <a href="#ref-for-authenticator②⑤③">(6)</a> <a href="#ref-for-authenticator②⑤④">(7)</a> <a href="#ref-for-authenticator②⑤⑤">(8)</a>
-    <li><a href="#ref-for-authenticator②⑤⑥">13.4.5. Revoked Attestation Certificates</a>
-    <li><a href="#ref-for-authenticator②⑤⑦">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-authenticator②⑤⑧">(2)</a> <a href="#ref-for-authenticator②⑤⑨">(3)</a> <a href="#ref-for-authenticator②⑥⓪">(4)</a> <a href="#ref-for-authenticator②⑥①">(5)</a>
-    <li><a href="#ref-for-authenticator②⑥②">14. Privacy Considerations</a>
-    <li><a href="#ref-for-authenticator②⑥③">14.1. De-anonymization Prevention Measures</a> <a href="#ref-for-authenticator②⑥④">(2)</a> <a href="#ref-for-authenticator②⑥⑤">(3)</a> <a href="#ref-for-authenticator②⑥⑥">(4)</a> <a href="#ref-for-authenticator②⑥⑦">(5)</a> <a href="#ref-for-authenticator②⑥⑧">(6)</a> <a href="#ref-for-authenticator②⑥⑨">(7)</a>
-    <li><a href="#ref-for-authenticator②⑦⓪">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-authenticator②⑦①">(2)</a> <a href="#ref-for-authenticator②⑦②">(3)</a> <a href="#ref-for-authenticator②⑦③">(4)</a> <a href="#ref-for-authenticator②⑦④">(5)</a>
-    <li><a href="#ref-for-authenticator②⑦⑤">14.3. Authenticator-local Biometric Recognition</a>
-    <li><a href="#ref-for-authenticator②⑦⑥">14.4. Privacy considerations for authenticators</a>
-    <li><a href="#ref-for-authenticator②⑦⑦">14.4.1. Attestation Privacy</a> <a href="#ref-for-authenticator②⑦⑧">(2)</a> <a href="#ref-for-authenticator②⑦⑨">(3)</a> <a href="#ref-for-authenticator②⑧⓪">(4)</a> <a href="#ref-for-authenticator②⑧①">(5)</a>
-    <li><a href="#ref-for-authenticator②⑧②">14.4.2. Privacy of personally identifying information Stored in Authenticators</a> <a href="#ref-for-authenticator②⑧③">(2)</a> <a href="#ref-for-authenticator②⑧④">(3)</a> <a href="#ref-for-authenticator②⑧⑤">(4)</a> <a href="#ref-for-authenticator②⑧⑥">(5)</a> <a href="#ref-for-authenticator②⑧⑦">(6)</a> <a href="#ref-for-authenticator②⑧⑧">(7)</a>
-    <li><a href="#ref-for-authenticator②⑧⑨">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-authenticator②⑨⓪">(2)</a> <a href="#ref-for-authenticator②⑨①">(3)</a> <a href="#ref-for-authenticator②⑨②">(4)</a> <a href="#ref-for-authenticator②⑨③">(5)</a> <a href="#ref-for-authenticator②⑨④">(6)</a>
-    <li><a href="#ref-for-authenticator②⑨⑤">14.6.2. Username Enumeration</a>
-    <li><a href="#ref-for-authenticator②⑨⑥">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-authenticator②⑨⑦">(2)</a> <a href="#ref-for-authenticator②⑨⑧">(3)</a>
-    <li><a href="#ref-for-authenticator②⑨⑨">15. Accessibility Considerations</a>
+    <li><a href="#ref-for-authenticator⑧②">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-authenticator⑧③">(2)</a> <a href="#ref-for-authenticator⑧④">(3)</a> <a href="#ref-for-authenticator⑧⑤">(4)</a>
+    <li><a href="#ref-for-authenticator⑧⑥">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
+    <li><a href="#ref-for-authenticator⑧⑦">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-authenticator⑧⑧">(2)</a> <a href="#ref-for-authenticator⑧⑨">(3)</a>
+    <li><a href="#ref-for-authenticator⑨⓪">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-authenticator⑨①">(2)</a>
+    <li><a href="#ref-for-authenticator⑨②">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
+    <li><a href="#ref-for-authenticator⑨③">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-authenticator⑨④">(2)</a> <a href="#ref-for-authenticator⑨⑤">(3)</a> <a href="#ref-for-authenticator⑨⑥">(4)</a> <a href="#ref-for-authenticator⑨⑦">(5)</a> <a href="#ref-for-authenticator⑨⑧">(6)</a> <a href="#ref-for-authenticator⑨⑨">(7)</a> <a href="#ref-for-authenticator①⓪⓪">(8)</a>
+    <li><a href="#ref-for-authenticator①⓪①">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
+    <li><a href="#ref-for-authenticator①⓪②">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-authenticator①⓪③">(2)</a>
+    <li><a href="#ref-for-authenticator①⓪④">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
+    <li><a href="#ref-for-authenticator①⓪⑤">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
+    <li><a href="#ref-for-authenticator①⓪⑥">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-authenticator①⓪⑦">(2)</a> <a href="#ref-for-authenticator①⓪⑧">(3)</a>
+    <li><a href="#ref-for-authenticator①⓪⑨">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-authenticator①①⓪">(2)</a> <a href="#ref-for-authenticator①①①">(3)</a>
+    <li><a href="#ref-for-authenticator①①②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-authenticator①①③">(2)</a> <a href="#ref-for-authenticator①①④">(3)</a> <a href="#ref-for-authenticator①①⑤">(4)</a> <a href="#ref-for-authenticator①①⑥">(5)</a> <a href="#ref-for-authenticator①①⑦">(6)</a>
+    <li><a href="#ref-for-authenticator①①⑧">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
+    <li><a href="#ref-for-authenticator①①⑨">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
+    <li><a href="#ref-for-authenticator①②⓪">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a> <a href="#ref-for-authenticator①②①">(2)</a> <a href="#ref-for-authenticator①②②">(3)</a> <a href="#ref-for-authenticator①②③">(4)</a> <a href="#ref-for-authenticator①②④">(5)</a> <a href="#ref-for-authenticator①②⑤">(6)</a>
+    <li><a href="#ref-for-authenticator①②⑥">6. WebAuthn Authenticator Model</a> <a href="#ref-for-authenticator①②⑦">(2)</a> <a href="#ref-for-authenticator①②⑧">(3)</a> <a href="#ref-for-authenticator①②⑨">(4)</a> <a href="#ref-for-authenticator①③⓪">(5)</a>
+    <li><a href="#ref-for-authenticator①③①">6.1. Authenticator Data</a> <a href="#ref-for-authenticator①③②">(2)</a>
+    <li><a href="#ref-for-authenticator①③③">6.1.3. Credential Backup State</a> <a href="#ref-for-authenticator①③④">(2)</a> <a href="#ref-for-authenticator①③⑤">(3)</a> <a href="#ref-for-authenticator①③⑥">(4)</a> <a href="#ref-for-authenticator①③⑦">(5)</a> <a href="#ref-for-authenticator①③⑧">(6)</a> <a href="#ref-for-authenticator①③⑨">(7)</a> <a href="#ref-for-authenticator①④⓪">(8)</a>
+    <li><a href="#ref-for-authenticator①④①">6.2. Authenticator Taxonomy</a> <a href="#ref-for-authenticator①④②">(2)</a> <a href="#ref-for-authenticator①④③">(3)</a> <a href="#ref-for-authenticator①④④">(4)</a> <a href="#ref-for-authenticator①④⑤">(5)</a> <a href="#ref-for-authenticator①④⑥">(6)</a>
+    <li><a href="#ref-for-authenticator①④⑦">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-authenticator①④⑧">(2)</a> <a href="#ref-for-authenticator①④⑨">(3)</a> <a href="#ref-for-authenticator①⑤⓪">(4)</a> <a href="#ref-for-authenticator①⑤①">(5)</a> <a href="#ref-for-authenticator①⑤②">(6)</a>
+    <li><a href="#ref-for-authenticator①⑤③">6.2.2. Credential Storage Modality</a> <a href="#ref-for-authenticator①⑤④">(2)</a> <a href="#ref-for-authenticator①⑤⑤">(3)</a> <a href="#ref-for-authenticator①⑤⑥">(4)</a> <a href="#ref-for-authenticator①⑤⑦">(5)</a> <a href="#ref-for-authenticator①⑤⑧">(6)</a> <a href="#ref-for-authenticator①⑤⑨">(7)</a> <a href="#ref-for-authenticator①⑥⓪">(8)</a> <a href="#ref-for-authenticator①⑥①">(9)</a> <a href="#ref-for-authenticator①⑥②">(10)</a> <a href="#ref-for-authenticator①⑥③">(11)</a> <a href="#ref-for-authenticator①⑥④">(12)</a> <a href="#ref-for-authenticator①⑥⑤">(13)</a> <a href="#ref-for-authenticator①⑥⑥">(14)</a> <a href="#ref-for-authenticator①⑥⑦">(15)</a>
+    <li><a href="#ref-for-authenticator①⑥⑧">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-authenticator①⑥⑨">(2)</a> <a href="#ref-for-authenticator①⑦⓪">(3)</a> <a href="#ref-for-authenticator①⑦①">(4)</a> <a href="#ref-for-authenticator①⑦②">(5)</a> <a href="#ref-for-authenticator①⑦③">(6)</a> <a href="#ref-for-authenticator①⑦④">(7)</a> <a href="#ref-for-authenticator①⑦⑤">(8)</a>
+    <li><a href="#ref-for-authenticator①⑦⑥">6.3.1. Lookup Credential Source by Credential ID Algorithm</a>
+    <li><a href="#ref-for-authenticator①⑦⑦">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-authenticator①⑦⑧">(2)</a> <a href="#ref-for-authenticator①⑦⑨">(3)</a> <a href="#ref-for-authenticator①⑧⓪">(4)</a> <a href="#ref-for-authenticator①⑧①">(5)</a> <a href="#ref-for-authenticator①⑧②">(6)</a>
+    <li><a href="#ref-for-authenticator①⑧③">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-authenticator①⑧④">(2)</a> <a href="#ref-for-authenticator①⑧⑤">(3)</a> <a href="#ref-for-authenticator①⑧⑥">(4)</a> <a href="#ref-for-authenticator①⑧⑦">(5)</a>
+    <li><a href="#ref-for-authenticator①⑧⑧">6.3.5. The silentCredentialDiscovery operation</a> <a href="#ref-for-authenticator①⑧⑨">(2)</a>
+    <li><a href="#ref-for-authenticator①⑨⓪">6.4.1. String Truncation</a> <a href="#ref-for-authenticator①⑨①">(2)</a>
+    <li><a href="#ref-for-authenticator①⑨②">6.4.2. Language and Direction Encoding</a>
+    <li><a href="#ref-for-authenticator①⑨③">6.5. Attestation</a> <a href="#ref-for-authenticator①⑨④">(2)</a> <a href="#ref-for-authenticator①⑨⑤">(3)</a> <a href="#ref-for-authenticator①⑨⑥">(4)</a> <a href="#ref-for-authenticator①⑨⑦">(5)</a> <a href="#ref-for-authenticator①⑨⑧">(6)</a> <a href="#ref-for-authenticator①⑨⑨">(7)</a> <a href="#ref-for-authenticator②⓪⓪">(8)</a> <a href="#ref-for-authenticator②⓪①">(9)</a> <a href="#ref-for-authenticator②⓪②">(10)</a> <a href="#ref-for-authenticator②⓪③">(11)</a> <a href="#ref-for-authenticator②⓪④">(12)</a>
+    <li><a href="#ref-for-authenticator②⓪⑤">6.5.2. Attestation Statement Formats</a>
+    <li><a href="#ref-for-authenticator②⓪⑥">6.5.3. Attestation Types</a> <a href="#ref-for-authenticator②⓪⑦">(2)</a> <a href="#ref-for-authenticator②⓪⑧">(3)</a> <a href="#ref-for-authenticator②⓪⑨">(4)</a> <a href="#ref-for-authenticator②①⓪">(5)</a> <a href="#ref-for-authenticator②①①">(6)</a>
+    <li><a href="#ref-for-authenticator②①②">6.5.4. Generating an Attestation Object</a>
+    <li><a href="#ref-for-authenticator②①③">6.5.5. Signature Formats for Packed Attestation, FIDO U2F Attestation, and Assertion Signatures</a> <a href="#ref-for-authenticator②①④">(2)</a>
+    <li><a href="#ref-for-authenticator②①⑤">7.1. Registering a New Credential</a> <a href="#ref-for-authenticator②①⑥">(2)</a> <a href="#ref-for-authenticator②①⑦">(3)</a>
+    <li><a href="#ref-for-authenticator②①⑧">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-authenticator②①⑨">8.2. Packed Attestation Statement Format</a>
+    <li><a href="#ref-for-authenticator②②⓪">8.4. Android Key Attestation Statement Format</a>
+    <li><a href="#ref-for-authenticator②②①">8.5. Android SafetyNet Attestation Statement Format</a>
+    <li><a href="#ref-for-authenticator②②②">8.7. None Attestation Statement Format</a> <a href="#ref-for-authenticator②②③">(2)</a> <a href="#ref-for-authenticator②②④">(3)</a>
+    <li><a href="#ref-for-authenticator②②⑤">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-authenticator②②⑥">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-authenticator②②⑦">(2)</a> <a href="#ref-for-authenticator②②⑧">(3)</a> <a href="#ref-for-authenticator②②⑨">(4)</a> <a href="#ref-for-authenticator②③⓪">(5)</a>
+    <li><a href="#ref-for-authenticator②③①">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-authenticator②③②">(2)</a> <a href="#ref-for-authenticator②③③">(3)</a> <a href="#ref-for-authenticator②③④">(4)</a>
+    <li><a href="#ref-for-authenticator②③⑤">10.2.1. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-authenticator②③⑥">13. Security Considerations</a> <a href="#ref-for-authenticator②③⑦">(2)</a> <a href="#ref-for-authenticator②③⑧">(3)</a> <a href="#ref-for-authenticator②③⑨">(4)</a>
+    <li><a href="#ref-for-authenticator②④⓪">13.1. Credential ID Unsigned</a>
+    <li><a href="#ref-for-authenticator②④①">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-authenticator②④②">(2)</a> <a href="#ref-for-authenticator②④③">(3)</a> <a href="#ref-for-authenticator②④④">(4)</a> <a href="#ref-for-authenticator②④⑤">(5)</a> <a href="#ref-for-authenticator②④⑥">(6)</a> <a href="#ref-for-authenticator②④⑦">(7)</a> <a href="#ref-for-authenticator②④⑧">(8)</a> <a href="#ref-for-authenticator②④⑨">(9)</a> <a href="#ref-for-authenticator②⑤⓪">(10)</a>
+    <li><a href="#ref-for-authenticator②⑤①">13.3. Security considerations for authenticators </a>
+    <li><a href="#ref-for-authenticator②⑤②">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a>
+    <li><a href="#ref-for-authenticator②⑤③">13.4.1. Security Benefits for WebAuthn Relying Parties</a> <a href="#ref-for-authenticator②⑤④">(2)</a> <a href="#ref-for-authenticator②⑤⑤">(3)</a> <a href="#ref-for-authenticator②⑤⑥">(4)</a> <a href="#ref-for-authenticator②⑤⑦">(5)</a> <a href="#ref-for-authenticator②⑤⑧">(6)</a>
+    <li><a href="#ref-for-authenticator②⑤⑨">13.4.4. Attestation Limitations</a> <a href="#ref-for-authenticator②⑥⓪">(2)</a> <a href="#ref-for-authenticator②⑥①">(3)</a> <a href="#ref-for-authenticator②⑥②">(4)</a> <a href="#ref-for-authenticator②⑥③">(5)</a> <a href="#ref-for-authenticator②⑥④">(6)</a> <a href="#ref-for-authenticator②⑥⑤">(7)</a> <a href="#ref-for-authenticator②⑥⑥">(8)</a>
+    <li><a href="#ref-for-authenticator②⑥⑦">13.4.5. Revoked Attestation Certificates</a>
+    <li><a href="#ref-for-authenticator②⑥⑧">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-authenticator②⑥⑨">(2)</a> <a href="#ref-for-authenticator②⑦⓪">(3)</a> <a href="#ref-for-authenticator②⑦①">(4)</a> <a href="#ref-for-authenticator②⑦②">(5)</a>
+    <li><a href="#ref-for-authenticator②⑦③">14. Privacy Considerations</a>
+    <li><a href="#ref-for-authenticator②⑦④">14.1. De-anonymization Prevention Measures</a> <a href="#ref-for-authenticator②⑦⑤">(2)</a> <a href="#ref-for-authenticator②⑦⑥">(3)</a> <a href="#ref-for-authenticator②⑦⑦">(4)</a> <a href="#ref-for-authenticator②⑦⑧">(5)</a> <a href="#ref-for-authenticator②⑦⑨">(6)</a> <a href="#ref-for-authenticator②⑧⓪">(7)</a>
+    <li><a href="#ref-for-authenticator②⑧①">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-authenticator②⑧②">(2)</a> <a href="#ref-for-authenticator②⑧③">(3)</a> <a href="#ref-for-authenticator②⑧④">(4)</a> <a href="#ref-for-authenticator②⑧⑤">(5)</a>
+    <li><a href="#ref-for-authenticator②⑧⑥">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-authenticator②⑧⑦">14.4. Privacy considerations for authenticators</a>
+    <li><a href="#ref-for-authenticator②⑧⑧">14.4.1. Attestation Privacy</a> <a href="#ref-for-authenticator②⑧⑨">(2)</a> <a href="#ref-for-authenticator②⑨⓪">(3)</a> <a href="#ref-for-authenticator②⑨①">(4)</a> <a href="#ref-for-authenticator②⑨②">(5)</a>
+    <li><a href="#ref-for-authenticator②⑨③">14.4.2. Privacy of personally identifying information Stored in Authenticators</a> <a href="#ref-for-authenticator②⑨④">(2)</a> <a href="#ref-for-authenticator②⑨⑤">(3)</a> <a href="#ref-for-authenticator②⑨⑥">(4)</a> <a href="#ref-for-authenticator②⑨⑦">(5)</a> <a href="#ref-for-authenticator②⑨⑧">(6)</a> <a href="#ref-for-authenticator②⑨⑨">(7)</a>
+    <li><a href="#ref-for-authenticator③⓪⓪">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-authenticator③⓪①">(2)</a> <a href="#ref-for-authenticator③⓪②">(3)</a> <a href="#ref-for-authenticator③⓪③">(4)</a> <a href="#ref-for-authenticator③⓪④">(5)</a> <a href="#ref-for-authenticator③⓪⑤">(6)</a>
+    <li><a href="#ref-for-authenticator③⓪⑥">14.6.1. User Handle Contents</a>
+    <li><a href="#ref-for-authenticator③⓪⑦">14.6.2. Username Enumeration</a>
+    <li><a href="#ref-for-authenticator③⓪⑧">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-authenticator③⓪⑨">(2)</a> <a href="#ref-for-authenticator③①⓪">(3)</a>
+    <li><a href="#ref-for-authenticator③①①">15. Accessibility Considerations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="webauthn-authenticator">
@@ -9709,6 +10869,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#backed-up">#backed-up</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-backed-up">4. Terminology</a>
+    <li><a href="#ref-for-backed-up①">6.1. Authenticator Data</a> <a href="#ref-for-backed-up②">(2)</a>
+    <li><a href="#ref-for-backed-up③">6.1.3. Credential Backup State</a> <a href="#ref-for-backed-up④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="backup-eligibility">
@@ -9717,7 +10879,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-backup-eligibility">4. Terminology</a>
     <li><a href="#ref-for-backup-eligibility①">6.1. Authenticator Data</a>
     <li><a href="#ref-for-backup-eligibility②">6.1.3. Credential Backup State</a>
-    <li><a href="#ref-for-backup-eligibility③">7.1. Registering a New Credential</a> <a href="#ref-for-backup-eligibility④">(2)</a>
+    <li><a href="#ref-for-backup-eligibility③">7.1. Registering a New Credential</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="backup-eligible">
+   <b><a href="#backup-eligible">#backup-eligible</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-backup-eligible">6.1. Authenticator Data</a> <a href="#ref-for-backup-eligible①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="multi-device-credential">
@@ -9740,8 +10908,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-backup-state">4. Terminology</a>
     <li><a href="#ref-for-backup-state①">6.1. Authenticator Data</a>
     <li><a href="#ref-for-backup-state②">6.1.3. Credential Backup State</a>
-    <li><a href="#ref-for-backup-state③">7.1. Registering a New Credential</a> <a href="#ref-for-backup-state④">(2)</a>
-    <li><a href="#ref-for-backup-state⑤">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-backup-state⑥">(2)</a>
+    <li><a href="#ref-for-backup-state③">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-backup-state④">7.2. Verifying an Authentication Assertion</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="biometric-authenticator">
+   <b><a href="#biometric-authenticator">#biometric-authenticator</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-biometric-authenticator">6.2.3. Authentication Factor Capability</a>
+    <li><a href="#ref-for-biometric-authenticator①">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-biometric-authenticator②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="biometric-recognition">
@@ -9752,19 +10927,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-biometric-recognition④">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-biometric-recognition⑤">(2)</a> <a href="#ref-for-biometric-recognition⑥">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="biometric-authenticator">
-   <b><a href="#biometric-authenticator">#biometric-authenticator</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-biometric-authenticator">6.2.3. Authentication Factor Capability</a>
-    <li><a href="#ref-for-biometric-authenticator①">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-biometric-authenticator②">(2)</a>
-   </ul>
-  </aside>
   <aside class="dfn-panel" data-for="bound-credential">
    <b><a href="#bound-credential">#bound-credential</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-bound-credential①">4. Terminology</a> <a href="#ref-for-bound-credential②">(2)</a> <a href="#ref-for-bound-credential③">(3)</a> <a href="#ref-for-bound-credential④">(4)</a> <a href="#ref-for-bound-credential⑤">(5)</a> <a href="#ref-for-bound-credential⑥">(6)</a>
     <li><a href="#ref-for-bound-credential⑦">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-bound-credential⑧">(2)</a> <a href="#ref-for-bound-credential⑨">(3)</a>
-    <li><a href="#ref-for-bound-credential①⓪">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-bound-credential①⓪">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
     <li><a href="#ref-for-bound-credential①①">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-bound-credential①②">(2)</a>
     <li><a href="#ref-for-bound-credential①③">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-bound-credential①④">(2)</a>
     <li><a href="#ref-for-bound-credential①⑤">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-bound-credential①⑥">(2)</a>
@@ -9790,15 +10958,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#ceremony">#ceremony</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-ceremony">1. Introduction</a>
-    <li><a href="#ref-for-ceremony①">4. Terminology</a> <a href="#ref-for-ceremony②">(2)</a> <a href="#ref-for-ceremony③">(3)</a> <a href="#ref-for-ceremony④">(4)</a> <a href="#ref-for-ceremony⑤">(5)</a> <a href="#ref-for-ceremony⑥">(6)</a> <a href="#ref-for-ceremony⑦">(7)</a>
-    <li><a href="#ref-for-ceremony⑧">5.1. PublicKeyCredential Interface</a>
-    <li><a href="#ref-for-ceremony⑨">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
-    <li><a href="#ref-for-ceremony①⓪">7. WebAuthn Relying Party Operations</a>
-    <li><a href="#ref-for-ceremony①①">13. Security Considerations</a>
-    <li><a href="#ref-for-ceremony①②">14.5.1. Registration Ceremony Privacy</a>
-    <li><a href="#ref-for-ceremony①③">14.5.2. Authentication Ceremony Privacy</a>
-    <li><a href="#ref-for-ceremony①④">14.6.2. Username Enumeration</a> <a href="#ref-for-ceremony①⑤">(2)</a>
-    <li><a href="#ref-for-ceremony①⑥">15. Accessibility Considerations</a>
+    <li><a href="#ref-for-ceremony①">4. Terminology</a> <a href="#ref-for-ceremony②">(2)</a> <a href="#ref-for-ceremony③">(3)</a> <a href="#ref-for-ceremony④">(4)</a> <a href="#ref-for-ceremony⑤">(5)</a> <a href="#ref-for-ceremony⑥">(6)</a> <a href="#ref-for-ceremony⑦">(7)</a> <a href="#ref-for-ceremony⑧">(8)</a> <a href="#ref-for-ceremony⑨">(9)</a>
+    <li><a href="#ref-for-ceremony①⓪">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-ceremony①①">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
+    <li><a href="#ref-for-ceremony①②">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-ceremony①③">13. Security Considerations</a>
+    <li><a href="#ref-for-ceremony①④">14.5.1. Registration Ceremony Privacy</a>
+    <li><a href="#ref-for-ceremony①⑤">14.5.2. Authentication Ceremony Privacy</a>
+    <li><a href="#ref-for-ceremony①⑥">14.6.2. Username Enumeration</a> <a href="#ref-for-ceremony①⑦">(2)</a>
+    <li><a href="#ref-for-ceremony①⑧">15. Accessibility Considerations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="client">
@@ -9808,42 +10976,47 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-client①">1.3.1. Registration</a> <a href="#ref-for-client②">(2)</a>
     <li><a href="#ref-for-client③">1.3.3. Authentication</a> <a href="#ref-for-client④">(2)</a> <a href="#ref-for-client⑤">(3)</a>
     <li><a href="#ref-for-client⑥">4. Terminology</a> <a href="#ref-for-client⑦">(2)</a> <a href="#ref-for-client⑧">(3)</a> <a href="#ref-for-client⑨">(4)</a> <a href="#ref-for-client①⓪">(5)</a> <a href="#ref-for-client①①">(6)</a> <a href="#ref-for-client①②">(7)</a> <a href="#ref-for-client①③">(8)</a> <a href="#ref-for-client①④">(9)</a>
-    <li><a href="#ref-for-client①⑤">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client①⑥">(2)</a> <a href="#ref-for-client①⑦">(3)</a> <a href="#ref-for-client①⑧">(4)</a> <a href="#ref-for-client①⑨">(5)</a>
-    <li><a href="#ref-for-client②⓪">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client②①">(2)</a> <a href="#ref-for-client②②">(3)</a> <a href="#ref-for-client②③">(4)</a>
-    <li><a href="#ref-for-client②④">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-client②⑤">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-client②⑥">(2)</a> <a href="#ref-for-client②⑦">(3)</a> <a href="#ref-for-client②⑧">(4)</a> <a href="#ref-for-client②⑨">(5)</a>
-    <li><a href="#ref-for-client③⓪">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-client③①">(2)</a> <a href="#ref-for-client③②">(3)</a>
-    <li><a href="#ref-for-client③③">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-client③④">(2)</a>
-    <li><a href="#ref-for-client③⑤">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a> <a href="#ref-for-client③⑥">(2)</a>
-    <li><a href="#ref-for-client③⑦">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-client③⑧">(2)</a> <a href="#ref-for-client③⑨">(3)</a> <a href="#ref-for-client④⓪">(4)</a>
-    <li><a href="#ref-for-client④①">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-client④②">(2)</a> <a href="#ref-for-client④③">(3)</a>
-    <li><a href="#ref-for-client④④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-client④⑤">(2)</a> <a href="#ref-for-client④⑥">(3)</a> <a href="#ref-for-client④⑦">(4)</a> <a href="#ref-for-client④⑧">(5)</a> <a href="#ref-for-client④⑨">(6)</a>
-    <li><a href="#ref-for-client⑤⓪">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
-    <li><a href="#ref-for-client⑤①">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
-    <li><a href="#ref-for-client⑤②">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-client⑤③">(2)</a>
-    <li><a href="#ref-for-client⑤④">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
-    <li><a href="#ref-for-client⑤⑤">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
-    <li><a href="#ref-for-client⑤⑥">6. WebAuthn Authenticator Model</a> <a href="#ref-for-client⑤⑦">(2)</a>
-    <li><a href="#ref-for-client⑤⑧">6.1. Authenticator Data</a> <a href="#ref-for-client⑤⑨">(2)</a>
-    <li><a href="#ref-for-client⑥⓪">6.2. Authenticator Taxonomy</a>
-    <li><a href="#ref-for-client⑥①">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-client⑥②">(2)</a> <a href="#ref-for-client⑥③">(3)</a> <a href="#ref-for-client⑥④">(4)</a> <a href="#ref-for-client⑥⑤">(5)</a>
-    <li><a href="#ref-for-client⑥⑥">6.2.2. Credential Storage Modality</a>
-    <li><a href="#ref-for-client⑥⑦">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-client⑥⑧">(2)</a> <a href="#ref-for-client⑥⑨">(3)</a> <a href="#ref-for-client⑦⓪">(4)</a>
-    <li><a href="#ref-for-client⑦①">7.1. Registering a New Credential</a> <a href="#ref-for-client⑦②">(2)</a>
-    <li><a href="#ref-for-client⑦③">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-client⑦④">8.6. FIDO U2F Attestation Statement Format</a>
-    <li><a href="#ref-for-client⑦⑤">9. WebAuthn Extensions</a> <a href="#ref-for-client⑦⑥">(2)</a>
-    <li><a href="#ref-for-client⑦⑦">9.4. Client Extension Processing</a>
-    <li><a href="#ref-for-client⑦⑧">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-client⑦⑨">12.4. WebAuthn Extension Identifier Registrations</a>
-    <li><a href="#ref-for-client⑧⓪">13. Security Considerations</a>
-    <li><a href="#ref-for-client⑧①">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-client⑧②">(2)</a> <a href="#ref-for-client⑧③">(3)</a> <a href="#ref-for-client⑧④">(4)</a> <a href="#ref-for-client⑧⑤">(5)</a> <a href="#ref-for-client⑧⑥">(6)</a> <a href="#ref-for-client⑧⑦">(7)</a> <a href="#ref-for-client⑧⑧">(8)</a>
-    <li><a href="#ref-for-client⑧⑨">14. Privacy Considerations</a>
-    <li><a href="#ref-for-client⑨⓪">14.1. De-anonymization Prevention Measures</a> <a href="#ref-for-client⑨①">(2)</a> <a href="#ref-for-client⑨②">(3)</a> <a href="#ref-for-client⑨③">(4)</a> <a href="#ref-for-client⑨④">(5)</a>
-    <li><a href="#ref-for-client⑨⑤">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-client⑨⑥">(2)</a> <a href="#ref-for-client⑨⑦">(3)</a>
-    <li><a href="#ref-for-client⑨⑧">14.3. Authenticator-local Biometric Recognition</a>
-    <li><a href="#ref-for-client⑨⑨">14.4.2. Privacy of personally identifying information Stored in Authenticators</a> <a href="#ref-for-client①⓪⓪">(2)</a>
-    <li><a href="#ref-for-client①⓪①">14.5. Privacy considerations for clients</a>
+    <li><a href="#ref-for-client①⑤">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-client①⑥">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client①⑦">(2)</a> <a href="#ref-for-client①⑧">(3)</a> <a href="#ref-for-client①⑨">(4)</a> <a href="#ref-for-client②⓪">(5)</a>
+    <li><a href="#ref-for-client②①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client②②">(2)</a> <a href="#ref-for-client②③">(3)</a> <a href="#ref-for-client②④">(4)</a>
+    <li><a href="#ref-for-client②⑤">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-client②⑥">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-client②⑦">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-client②⑧">(2)</a> <a href="#ref-for-client②⑨">(3)</a>
+    <li><a href="#ref-for-client③⓪">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a> <a href="#ref-for-client③①">(2)</a> <a href="#ref-for-client③②">(3)</a>
+    <li><a href="#ref-for-client③③">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-client③④">(2)</a> <a href="#ref-for-client③⑤">(3)</a> <a href="#ref-for-client③⑥">(4)</a> <a href="#ref-for-client③⑦">(5)</a>
+    <li><a href="#ref-for-client③⑧">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-client③⑨">(2)</a> <a href="#ref-for-client④⓪">(3)</a>
+    <li><a href="#ref-for-client④①">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-client④②">(2)</a>
+    <li><a href="#ref-for-client④③">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a> <a href="#ref-for-client④④">(2)</a>
+    <li><a href="#ref-for-client④⑤">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-client④⑥">(2)</a> <a href="#ref-for-client④⑦">(3)</a> <a href="#ref-for-client④⑧">(4)</a>
+    <li><a href="#ref-for-client④⑨">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-client⑤⓪">(2)</a> <a href="#ref-for-client⑤①">(3)</a>
+    <li><a href="#ref-for-client⑤②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-client⑤③">(2)</a> <a href="#ref-for-client⑤④">(3)</a> <a href="#ref-for-client⑤⑤">(4)</a> <a href="#ref-for-client⑤⑥">(5)</a> <a href="#ref-for-client⑤⑦">(6)</a>
+    <li><a href="#ref-for-client⑤⑧">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
+    <li><a href="#ref-for-client⑤⑨">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
+    <li><a href="#ref-for-client⑥⓪">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-client⑥①">(2)</a>
+    <li><a href="#ref-for-client⑥②">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
+    <li><a href="#ref-for-client⑥③">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
+    <li><a href="#ref-for-client⑥④">6. WebAuthn Authenticator Model</a> <a href="#ref-for-client⑥⑤">(2)</a>
+    <li><a href="#ref-for-client⑥⑥">6.1. Authenticator Data</a> <a href="#ref-for-client⑥⑦">(2)</a>
+    <li><a href="#ref-for-client⑥⑧">6.2. Authenticator Taxonomy</a>
+    <li><a href="#ref-for-client⑥⑨">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-client⑦⓪">(2)</a> <a href="#ref-for-client⑦①">(3)</a> <a href="#ref-for-client⑦②">(4)</a> <a href="#ref-for-client⑦③">(5)</a>
+    <li><a href="#ref-for-client⑦④">6.2.2. Credential Storage Modality</a>
+    <li><a href="#ref-for-client⑦⑤">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-client⑦⑥">(2)</a> <a href="#ref-for-client⑦⑦">(3)</a> <a href="#ref-for-client⑦⑧">(4)</a>
+    <li><a href="#ref-for-client⑦⑨">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-client⑧⓪">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-client⑧①">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-client⑧②">8.6. FIDO U2F Attestation Statement Format</a>
+    <li><a href="#ref-for-client⑧③">9. WebAuthn Extensions</a> <a href="#ref-for-client⑧④">(2)</a>
+    <li><a href="#ref-for-client⑧⑤">9.4. Client Extension Processing</a>
+    <li><a href="#ref-for-client⑧⑥">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-client⑧⑦">12.4. WebAuthn Extension Identifier Registrations</a>
+    <li><a href="#ref-for-client⑧⑧">13. Security Considerations</a>
+    <li><a href="#ref-for-client⑧⑨">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-client⑨⓪">(2)</a> <a href="#ref-for-client⑨①">(3)</a> <a href="#ref-for-client⑨②">(4)</a> <a href="#ref-for-client⑨③">(5)</a> <a href="#ref-for-client⑨④">(6)</a> <a href="#ref-for-client⑨⑤">(7)</a> <a href="#ref-for-client⑨⑥">(8)</a>
+    <li><a href="#ref-for-client⑨⑦">14. Privacy Considerations</a>
+    <li><a href="#ref-for-client⑨⑧">14.1. De-anonymization Prevention Measures</a> <a href="#ref-for-client⑨⑨">(2)</a> <a href="#ref-for-client①⓪⓪">(3)</a> <a href="#ref-for-client①⓪①">(4)</a> <a href="#ref-for-client①⓪②">(5)</a>
+    <li><a href="#ref-for-client①⓪③">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-client①⓪④">(2)</a> <a href="#ref-for-client①⓪⑤">(3)</a>
+    <li><a href="#ref-for-client①⓪⑥">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-client①⓪⑦">14.4.2. Privacy of personally identifying information Stored in Authenticators</a> <a href="#ref-for-client①⓪⑧">(2)</a>
+    <li><a href="#ref-for-client①⓪⑨">14.5. Privacy considerations for clients</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="webauthn-client">
@@ -9853,6 +11026,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-webauthn-client①">4. Terminology</a> <a href="#ref-for-webauthn-client②">(2)</a> <a href="#ref-for-webauthn-client③">(3)</a> <a href="#ref-for-webauthn-client④">(4)</a> <a href="#ref-for-webauthn-client⑤">(5)</a>
     <li><a href="#ref-for-webauthn-client⑥">6.3. Authenticator Operations</a>
     <li><a href="#ref-for-webauthn-client⑦">13. Security Considerations</a>
+    <li><a href="#ref-for-webauthn-client⑧">13.4.8. Code injection attacks</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="client-device">
@@ -9890,25 +11064,26 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-client-platform①④">5. Web Authentication API</a> <a href="#ref-for-client-platform①⑤">(2)</a>
     <li><a href="#ref-for-client-platform①⑥">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client-platform①⑦">(2)</a> <a href="#ref-for-client-platform①⑧">(3)</a> <a href="#ref-for-client-platform①⑨">(4)</a>
     <li><a href="#ref-for-client-platform②⓪">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
-    <li><a href="#ref-for-client-platform②①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client-platform②②">(2)</a> <a href="#ref-for-client-platform②③">(3)</a> <a href="#ref-for-client-platform②④">(4)</a> <a href="#ref-for-client-platform②⑤">(5)</a> <a href="#ref-for-client-platform②⑥">(6)</a>
-    <li><a href="#ref-for-client-platform②⑦">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-client-platform②⑧">5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)</a>
-    <li><a href="#ref-for-client-platform②⑨">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-client-platform③⓪">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
-    <li><a href="#ref-for-client-platform③①">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>
-    <li><a href="#ref-for-client-platform③②">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-client-platform③③">(2)</a> <a href="#ref-for-client-platform③④">(3)</a>
-    <li><a href="#ref-for-client-platform③⑤">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-client-platform③⑥">(2)</a>
-    <li><a href="#ref-for-client-platform③⑦">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-client-platform③⑧">(2)</a>
-    <li><a href="#ref-for-client-platform③⑨">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-client-platform④⓪">(2)</a>
-    <li><a href="#ref-for-client-platform④①">6. WebAuthn Authenticator Model</a> <a href="#ref-for-client-platform④②">(2)</a>
-    <li><a href="#ref-for-client-platform④③">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-client-platform④④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-client-platform④⑤">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-client-platform④⑥">9. WebAuthn Extensions</a>
-    <li><a href="#ref-for-client-platform④⑦">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-client-platform④⑧">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-client-platform④⑨">(2)</a> <a href="#ref-for-client-platform⑤⓪">(3)</a>
-    <li><a href="#ref-for-client-platform⑤①">13.4.2. Visibility Considerations for Embedded Usage</a>
-    <li><a href="#ref-for-client-platform⑤②">15. Accessibility Considerations</a> <a href="#ref-for-client-platform⑤③">(2)</a>
+    <li><a href="#ref-for-client-platform②①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client-platform②②">(2)</a> <a href="#ref-for-client-platform②③">(3)</a> <a href="#ref-for-client-platform②④">(4)</a> <a href="#ref-for-client-platform②⑤">(5)</a>
+    <li><a href="#ref-for-client-platform②⑥">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-client-platform②⑦">(2)</a> <a href="#ref-for-client-platform②⑧">(3)</a>
+    <li><a href="#ref-for-client-platform②⑨">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-client-platform③⓪">5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)</a>
+    <li><a href="#ref-for-client-platform③①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-client-platform③②">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
+    <li><a href="#ref-for-client-platform③③">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>
+    <li><a href="#ref-for-client-platform③④">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-client-platform③⑤">(2)</a> <a href="#ref-for-client-platform③⑥">(3)</a>
+    <li><a href="#ref-for-client-platform③⑦">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-client-platform③⑧">(2)</a>
+    <li><a href="#ref-for-client-platform③⑨">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-client-platform④⓪">(2)</a>
+    <li><a href="#ref-for-client-platform④①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-client-platform④②">(2)</a>
+    <li><a href="#ref-for-client-platform④③">6. WebAuthn Authenticator Model</a> <a href="#ref-for-client-platform④④">(2)</a>
+    <li><a href="#ref-for-client-platform④⑤">6.1. Authenticator Data</a>
+    <li><a href="#ref-for-client-platform④⑥">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-client-platform④⑦">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-client-platform④⑧">9. WebAuthn Extensions</a>
+    <li><a href="#ref-for-client-platform④⑨">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-client-platform⑤⓪">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-client-platform⑤①">(2)</a> <a href="#ref-for-client-platform⑤②">(3)</a>
+    <li><a href="#ref-for-client-platform⑤③">13.4.2. Visibility Considerations for Embedded Usage</a>
+    <li><a href="#ref-for-client-platform⑤④">15. Accessibility Considerations</a> <a href="#ref-for-client-platform⑤⑤">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="client-side">
@@ -9934,10 +11109,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-client-side-discoverable-credential">4. Terminology</a> <a href="#ref-for-client-side-discoverable-credential①">(2)</a> <a href="#ref-for-client-side-discoverable-credential②">(3)</a> <a href="#ref-for-client-side-discoverable-credential③">(4)</a> <a href="#ref-for-client-side-discoverable-credential④">(5)</a> <a href="#ref-for-client-side-discoverable-credential⑤">(6)</a>
     <li><a href="#ref-for-client-side-discoverable-credential⑥">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
     <li><a href="#ref-for-client-side-discoverable-credential⑦">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-client-side-discoverable-credential⑧">(2)</a> <a href="#ref-for-client-side-discoverable-credential⑨">(3)</a> <a href="#ref-for-client-side-discoverable-credential①⓪">(4)</a> <a href="#ref-for-client-side-discoverable-credential①①">(5)</a> <a href="#ref-for-client-side-discoverable-credential①②">(6)</a> <a href="#ref-for-client-side-discoverable-credential①③">(7)</a>
-    <li><a href="#ref-for-client-side-discoverable-credential①④">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-client-side-discoverable-credential①⑤">11.2. Virtual Authenticators</a>
-    <li><a href="#ref-for-client-side-discoverable-credential①⑥">11.5. Add Credential</a>
-    <li><a href="#ref-for-client-side-discoverable-credential①⑦">14.6.3. Privacy leak via credential IDs</a>
+    <li><a href="#ref-for-client-side-discoverable-credential①④">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-client-side-discoverable-credential①⑤">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-client-side-discoverable-credential①⑥">11.2. Virtual Authenticators</a>
+    <li><a href="#ref-for-client-side-discoverable-credential①⑦">11.5. Add Credential</a>
+    <li><a href="#ref-for-client-side-discoverable-credential①⑧">14.6.3. Privacy leak via credential IDs</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="discoverable-credential">
@@ -9950,8 +11126,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-discoverable-credential⑦">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-discoverable-credential⑧">(2)</a>
     <li><a href="#ref-for-discoverable-credential⑨">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-discoverable-credential①⓪">(2)</a>
     <li><a href="#ref-for-discoverable-credential①①">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-discoverable-credential①②">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-discoverable-credential①③">(2)</a> <a href="#ref-for-discoverable-credential①④">(3)</a>
-    <li><a href="#ref-for-discoverable-credential①⑤">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-discoverable-credential①⑥">(2)</a>
+    <li><a href="#ref-for-discoverable-credential①②">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-discoverable-credential①③">(2)</a> <a href="#ref-for-discoverable-credential①④">(3)</a>
+    <li><a href="#ref-for-discoverable-credential①⑤">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-discoverable-credential①⑥">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="resident-credential">
@@ -9983,24 +11159,27 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-credential-id">1.3.1. Registration</a>
     <li><a href="#ref-for-credential-id①">1.3.3. Authentication</a> <a href="#ref-for-credential-id②">(2)</a> <a href="#ref-for-credential-id③">(3)</a>
-    <li><a href="#ref-for-credential-id④">4. Terminology</a> <a href="#ref-for-credential-id⑤">(2)</a> <a href="#ref-for-credential-id⑥">(3)</a> <a href="#ref-for-credential-id⑦">(4)</a> <a href="#ref-for-credential-id⑧">(5)</a> <a href="#ref-for-credential-id⑨">(6)</a> <a href="#ref-for-credential-id①⓪">(7)</a> <a href="#ref-for-credential-id①①">(8)</a> <a href="#ref-for-credential-id①②">(9)</a> <a href="#ref-for-credential-id①③">(10)</a> <a href="#ref-for-credential-id①④">(11)</a> <a href="#ref-for-credential-id①⑤">(12)</a> <a href="#ref-for-credential-id①⑥">(13)</a>
-    <li><a href="#ref-for-credential-id①⑦">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-credential-id①⑧">(2)</a>
-    <li><a href="#ref-for-credential-id①⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-credential-id②⓪">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-credential-id②①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
-    <li><a href="#ref-for-credential-id②②">6.2.2. Credential Storage Modality</a> <a href="#ref-for-credential-id②③">(2)</a> <a href="#ref-for-credential-id②④">(3)</a>
-    <li><a href="#ref-for-credential-id②⑤">6.3.1. Lookup Credential Source by Credential ID Algorithm</a>
-    <li><a href="#ref-for-credential-id②⑥">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-credential-id②⑦">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-credential-id②⑧">6.5.1. Attested Credential Data</a>
-    <li><a href="#ref-for-credential-id②⑨">7.1. Registering a New Credential</a> <a href="#ref-for-credential-id③⓪">(2)</a> <a href="#ref-for-credential-id③①">(3)</a> <a href="#ref-for-credential-id③②">(4)</a>
-    <li><a href="#ref-for-credential-id③③">8.6. FIDO U2F Attestation Statement Format</a>
-    <li><a href="#ref-for-credential-id③④">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-credential-id③⑤">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-credential-id③⑥">13.1. Credential ID Unsigned</a> <a href="#ref-for-credential-id③⑦">(2)</a> <a href="#ref-for-credential-id③⑧">(3)</a>
-    <li><a href="#ref-for-credential-id③⑨">14.1. De-anonymization Prevention Measures</a>
-    <li><a href="#ref-for-credential-id④⓪">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-credential-id④①">(2)</a> <a href="#ref-for-credential-id④②">(3)</a>
-    <li><a href="#ref-for-credential-id④③">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-credential-id④④">(2)</a> <a href="#ref-for-credential-id④⑤">(3)</a> <a href="#ref-for-credential-id④⑥">(4)</a> <a href="#ref-for-credential-id④⑦">(5)</a> <a href="#ref-for-credential-id④⑧">(6)</a> <a href="#ref-for-credential-id④⑨">(7)</a>
+    <li><a href="#ref-for-credential-id④">4. Terminology</a> <a href="#ref-for-credential-id⑤">(2)</a> <a href="#ref-for-credential-id⑥">(3)</a> <a href="#ref-for-credential-id⑦">(4)</a> <a href="#ref-for-credential-id⑧">(5)</a> <a href="#ref-for-credential-id⑨">(6)</a> <a href="#ref-for-credential-id①⓪">(7)</a> <a href="#ref-for-credential-id①①">(8)</a> <a href="#ref-for-credential-id①②">(9)</a> <a href="#ref-for-credential-id①③">(10)</a> <a href="#ref-for-credential-id①④">(11)</a> <a href="#ref-for-credential-id①⑤">(12)</a> <a href="#ref-for-credential-id①⑥">(13)</a> <a href="#ref-for-credential-id①⑦">(14)</a>
+    <li><a href="#ref-for-credential-id①⑧">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-credential-id①⑨">(2)</a>
+    <li><a href="#ref-for-credential-id②⓪">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-credential-id②①">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-credential-id②②">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-credential-id②③">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
+    <li><a href="#ref-for-credential-id②④">6.2.2. Credential Storage Modality</a> <a href="#ref-for-credential-id②⑤">(2)</a> <a href="#ref-for-credential-id②⑥">(3)</a>
+    <li><a href="#ref-for-credential-id②⑦">6.3.1. Lookup Credential Source by Credential ID Algorithm</a>
+    <li><a href="#ref-for-credential-id②⑧">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-credential-id②⑨">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-credential-id③⓪">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-credential-id③①">6.5.1. Attested Credential Data</a>
+    <li><a href="#ref-for-credential-id③②">7.1. Registering a New Credential</a> <a href="#ref-for-credential-id③③">(2)</a> <a href="#ref-for-credential-id③④">(3)</a> <a href="#ref-for-credential-id③⑤">(4)</a>
+    <li><a href="#ref-for-credential-id③⑥">8.6. FIDO U2F Attestation Statement Format</a>
+    <li><a href="#ref-for-credential-id③⑦">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-credential-id③⑧">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-credential-id③⑨">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-credential-id④⓪">(2)</a>
+    <li><a href="#ref-for-credential-id④①">13.1. Credential ID Unsigned</a> <a href="#ref-for-credential-id④②">(2)</a> <a href="#ref-for-credential-id④③">(3)</a>
+    <li><a href="#ref-for-credential-id④④">14.1. De-anonymization Prevention Measures</a>
+    <li><a href="#ref-for-credential-id④⑤">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-credential-id④⑥">(2)</a> <a href="#ref-for-credential-id④⑦">(3)</a>
+    <li><a href="#ref-for-credential-id④⑧">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-credential-id④⑨">(2)</a> <a href="#ref-for-credential-id⑤⓪">(3)</a> <a href="#ref-for-credential-id⑤①">(4)</a> <a href="#ref-for-credential-id⑤②">(5)</a> <a href="#ref-for-credential-id⑤③">(6)</a> <a href="#ref-for-credential-id⑤④">(7)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="credential-key-pair">
@@ -10032,15 +11211,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#credential-public-key">#credential-public-key</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-credential-public-key">1.3.1. Registration</a> <a href="#ref-for-credential-public-key①">(2)</a>
-    <li><a href="#ref-for-credential-public-key②">4. Terminology</a> <a href="#ref-for-credential-public-key③">(2)</a> <a href="#ref-for-credential-public-key④">(3)</a> <a href="#ref-for-credential-public-key⑤">(4)</a> <a href="#ref-for-credential-public-key⑥">(5)</a> <a href="#ref-for-credential-public-key⑦">(6)</a> <a href="#ref-for-credential-public-key⑧">(7)</a> <a href="#ref-for-credential-public-key⑨">(8)</a> <a href="#ref-for-credential-public-key①⓪">(9)</a> <a href="#ref-for-credential-public-key①①">(10)</a>
-    <li><a href="#ref-for-credential-public-key①②">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-credential-public-key①③">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-credential-public-key①④">(2)</a> <a href="#ref-for-credential-public-key①⑤">(3)</a> <a href="#ref-for-credential-public-key①⑥">(4)</a> <a href="#ref-for-credential-public-key①⑦">(5)</a> <a href="#ref-for-credential-public-key①⑧">(6)</a> <a href="#ref-for-credential-public-key①⑨">(7)</a> <a href="#ref-for-credential-public-key②⓪">(8)</a>
-    <li><a href="#ref-for-credential-public-key②①">5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)</a>
-    <li><a href="#ref-for-credential-public-key②②">6. WebAuthn Authenticator Model</a>
-    <li><a href="#ref-for-credential-public-key②③">6.5. Attestation</a> <a href="#ref-for-credential-public-key②④">(2)</a> <a href="#ref-for-credential-public-key②⑤">(3)</a>
-    <li><a href="#ref-for-credential-public-key②⑥">6.5.1. Attested Credential Data</a> <a href="#ref-for-credential-public-key②⑦">(2)</a> <a href="#ref-for-credential-public-key②⑧">(3)</a>
-    <li><a href="#ref-for-credential-public-key②⑨">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-credential-public-key③⓪">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-credential-public-key③①">(2)</a>
+    <li><a href="#ref-for-credential-public-key②">4. Terminology</a> <a href="#ref-for-credential-public-key③">(2)</a> <a href="#ref-for-credential-public-key④">(3)</a> <a href="#ref-for-credential-public-key⑤">(4)</a> <a href="#ref-for-credential-public-key⑥">(5)</a> <a href="#ref-for-credential-public-key⑦">(6)</a> <a href="#ref-for-credential-public-key⑧">(7)</a> <a href="#ref-for-credential-public-key⑨">(8)</a> <a href="#ref-for-credential-public-key①⓪">(9)</a> <a href="#ref-for-credential-public-key①①">(10)</a> <a href="#ref-for-credential-public-key①②">(11)</a>
+    <li><a href="#ref-for-credential-public-key①③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-credential-public-key①④">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-credential-public-key①⑤">(2)</a> <a href="#ref-for-credential-public-key①⑥">(3)</a> <a href="#ref-for-credential-public-key①⑦">(4)</a> <a href="#ref-for-credential-public-key①⑧">(5)</a> <a href="#ref-for-credential-public-key①⑨">(6)</a> <a href="#ref-for-credential-public-key②⓪">(7)</a> <a href="#ref-for-credential-public-key②①">(8)</a>
+    <li><a href="#ref-for-credential-public-key②②">5.8.5. Cryptographic Algorithm Identifier (typedef COSEAlgorithmIdentifier)</a>
+    <li><a href="#ref-for-credential-public-key②③">6. WebAuthn Authenticator Model</a>
+    <li><a href="#ref-for-credential-public-key②④">6.5. Attestation</a> <a href="#ref-for-credential-public-key②⑤">(2)</a> <a href="#ref-for-credential-public-key②⑥">(3)</a>
+    <li><a href="#ref-for-credential-public-key②⑦">6.5.1. Attested Credential Data</a> <a href="#ref-for-credential-public-key②⑧">(2)</a> <a href="#ref-for-credential-public-key②⑨">(3)</a>
+    <li><a href="#ref-for-credential-public-key③⓪">7.1. Registering a New Credential</a> <a href="#ref-for-credential-public-key③①">(2)</a>
     <li><a href="#ref-for-credential-public-key③②">8.6. FIDO U2F Attestation Statement Format</a>
     <li><a href="#ref-for-credential-public-key③③">8.8. Apple Anonymous Attestation Statement Format</a> <a href="#ref-for-credential-public-key③④">(2)</a>
     <li><a href="#ref-for-credential-public-key③⑤">13.1. Credential ID Unsigned</a>
@@ -10060,7 +11238,85 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#credential-properties">#credential-properties</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-credential-properties">4. Terminology</a> <a href="#ref-for-credential-properties①">(2)</a>
-    <li><a href="#ref-for-credential-properties②">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-credential-properties③">(2)</a>
+    <li><a href="#ref-for-credential-properties②">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-credential-properties③">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record">
+   <b><a href="#credential-record">#credential-record</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record">4. Terminology</a> <a href="#ref-for-credential-record①">(2)</a> <a href="#ref-for-credential-record②">(3)</a> <a href="#ref-for-credential-record③">(4)</a> <a href="#ref-for-credential-record④">(5)</a>
+    <li><a href="#ref-for-credential-record⑤">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-credential-record⑥">7.1. Registering a New Credential</a> <a href="#ref-for-credential-record⑦">(2)</a>
+    <li><a href="#ref-for-credential-record⑧">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-credential-record⑨">(2)</a> <a href="#ref-for-credential-record①⓪">(3)</a> <a href="#ref-for-credential-record①①">(4)</a> <a href="#ref-for-credential-record①②">(5)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-type">
+   <b><a href="#credential-record-type">#credential-record-type</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-type">4. Terminology</a>
+    <li><a href="#ref-for-credential-record-type①">7.1. Registering a New Credential</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-id">
+   <b><a href="#credential-record-id">#credential-record-id</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-id">4. Terminology</a>
+    <li><a href="#ref-for-credential-record-id①">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-credential-record-id②">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-credential-record-id③">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-publickey">
+   <b><a href="#credential-record-publickey">#credential-record-publickey</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-publickey">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-credential-record-publickey①">7.2. Verifying an Authentication Assertion</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-signcount">
+   <b><a href="#credential-record-signcount">#credential-record-signcount</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-signcount">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-credential-record-signcount①">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-credential-record-signcount②">(2)</a> <a href="#ref-for-credential-record-signcount③">(3)</a> <a href="#ref-for-credential-record-signcount④">(4)</a> <a href="#ref-for-credential-record-signcount⑤">(5)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-transports">
+   <b><a href="#credential-record-transports">#credential-record-transports</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-transports">4. Terminology</a>
+    <li><a href="#ref-for-credential-record-transports①">7.1. Registering a New Credential</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-be">
+   <b><a href="#credential-record-be">#credential-record-be</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-be">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-credential-record-be①">7.2. Verifying an Authentication Assertion</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-bs">
+   <b><a href="#credential-record-bs">#credential-record-bs</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-bs">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-credential-record-bs①">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-credential-record-bs②">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-attestationobject">
+   <b><a href="#credential-record-attestationobject">#credential-record-attestationobject</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-attestationobject">4. Terminology</a>
+    <li><a href="#ref-for-credential-record-attestationobject①">7.1. Registering a New Credential</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-record-attestationclientdatajson">
+   <b><a href="#credential-record-attestationclientdatajson">#credential-record-attestationclientdatajson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-record-attestationclientdatajson">7.1. Registering a New Credential</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="credential-descriptor-for-a-credential-record">
+   <b><a href="#credential-descriptor-for-a-credential-record">#credential-descriptor-for-a-credential-record</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-credential-descriptor-for-a-credential-record">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="generating-authenticator">
@@ -10083,34 +11339,78 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-non-discoverable-credential">4. Terminology</a> <a href="#ref-for-non-discoverable-credential①">(2)</a>
     <li><a href="#ref-for-non-discoverable-credential②">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>
-    <li><a href="#ref-for-non-discoverable-credential③">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-non-discoverable-credential③">10.1.3. Credential Properties Extension (credProps)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="public-key-credential">
+   <b><a href="#public-key-credential">#public-key-credential</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-public-key-credential②">1. Introduction</a> <a href="#ref-for-public-key-credential③">(2)</a> <a href="#ref-for-public-key-credential④">(3)</a> <a href="#ref-for-public-key-credential⑤">(4)</a> <a href="#ref-for-public-key-credential⑥">(5)</a>
+    <li><a href="#ref-for-public-key-credential⑦">1.3. Sample API Usage Scenarios</a>
+    <li><a href="#ref-for-public-key-credential⑧">1.3.2. Registration Specifically with User-Verifying Platform Authenticator</a>
+    <li><a href="#ref-for-public-key-credential⑨">4. Terminology</a> <a href="#ref-for-public-key-credential①⓪">(2)</a> <a href="#ref-for-public-key-credential①①">(3)</a> <a href="#ref-for-public-key-credential①②">(4)</a> <a href="#ref-for-public-key-credential①③">(5)</a> <a href="#ref-for-public-key-credential①④">(6)</a> <a href="#ref-for-public-key-credential①⑤">(7)</a> <a href="#ref-for-public-key-credential①⑥">(8)</a> <a href="#ref-for-public-key-credential①⑦">(9)</a> <a href="#ref-for-public-key-credential①⑧">(10)</a> <a href="#ref-for-public-key-credential①⑨">(11)</a>
+    <li><a href="#ref-for-public-key-credential②⓪">5. Web Authentication API</a> <a href="#ref-for-public-key-credential②①">(2)</a> <a href="#ref-for-public-key-credential②②">(3)</a> <a href="#ref-for-public-key-credential②③">(4)</a>
+    <li><a href="#ref-for-public-key-credential②④">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-public-key-credential②⑤">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-public-key-credential②⑥">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
+    <li><a href="#ref-for-public-key-credential②⑦">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-public-key-credential②⑧">(2)</a>
+    <li><a href="#ref-for-public-key-credential②⑨">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-public-key-credential③⓪">(2)</a>
+    <li><a href="#ref-for-public-key-credential③①">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-public-key-credential③②">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
+    <li><a href="#ref-for-public-key-credential③③">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
+    <li><a href="#ref-for-public-key-credential③④">5.8. Supporting Data Structures</a>
+    <li><a href="#ref-for-public-key-credential③⑤">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-public-key-credential③⑥">(2)</a> <a href="#ref-for-public-key-credential③⑦">(3)</a> <a href="#ref-for-public-key-credential③⑧">(4)</a>
+    <li><a href="#ref-for-public-key-credential③⑨">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
+    <li><a href="#ref-for-public-key-credential④⓪">6. WebAuthn Authenticator Model</a> <a href="#ref-for-public-key-credential④①">(2)</a>
+    <li><a href="#ref-for-public-key-credential④②">6.1. Authenticator Data</a> <a href="#ref-for-public-key-credential④③">(2)</a>
+    <li><a href="#ref-for-public-key-credential④④">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-public-key-credential④⑤">(2)</a> <a href="#ref-for-public-key-credential④⑥">(3)</a>
+    <li><a href="#ref-for-public-key-credential④⑦">6.2.2. Credential Storage Modality</a>
+    <li><a href="#ref-for-public-key-credential④⑧">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-public-key-credential④⑨">6.5. Attestation</a> <a href="#ref-for-public-key-credential⑤⓪">(2)</a>
+    <li><a href="#ref-for-public-key-credential⑤①">6.5.2. Attestation Statement Formats</a>
+    <li><a href="#ref-for-public-key-credential⑤②">6.5.3. Attestation Types</a>
+    <li><a href="#ref-for-public-key-credential⑤③">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-public-key-credential⑤④">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-public-key-credential⑤⑤">8.6. FIDO U2F Attestation Statement Format</a>
+    <li><a href="#ref-for-public-key-credential⑤⑥">9. WebAuthn Extensions</a> <a href="#ref-for-public-key-credential⑤⑦">(2)</a>
+    <li><a href="#ref-for-public-key-credential⑤⑧">13.4.4. Attestation Limitations</a>
+    <li><a href="#ref-for-public-key-credential⑤⑨">13.4.5. Revoked Attestation Certificates</a> <a href="#ref-for-public-key-credential⑥⓪">(2)</a>
+    <li><a href="#ref-for-public-key-credential⑥①">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-public-key-credential⑥②">(2)</a> <a href="#ref-for-public-key-credential⑥③">(3)</a> <a href="#ref-for-public-key-credential⑥④">(4)</a> <a href="#ref-for-public-key-credential⑥⑤">(5)</a>
+    <li><a href="#ref-for-public-key-credential⑥⑥">13.4.8. Code injection attacks</a> <a href="#ref-for-public-key-credential⑥⑦">(2)</a>
+    <li><a href="#ref-for-public-key-credential⑥⑧">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-public-key-credential⑥⑨">(2)</a> <a href="#ref-for-public-key-credential⑦⓪">(3)</a> <a href="#ref-for-public-key-credential⑦①">(4)</a> <a href="#ref-for-public-key-credential⑦②">(5)</a> <a href="#ref-for-public-key-credential⑦③">(6)</a>
+    <li><a href="#ref-for-public-key-credential⑦④">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-public-key-credential⑦⑤">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-public-key-credential⑦⑥">(2)</a> <a href="#ref-for-public-key-credential⑦⑦">(3)</a>
+    <li><a href="#ref-for-public-key-credential⑦⑧">14.5.2. Authentication Ceremony Privacy</a> <a href="#ref-for-public-key-credential⑦⑨">(2)</a> <a href="#ref-for-public-key-credential⑧⓪">(3)</a> <a href="#ref-for-public-key-credential⑧①">(4)</a> <a href="#ref-for-public-key-credential⑧②">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source">
    <b><a href="#public-key-credential-source">#public-key-credential-source</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-public-key-credential-source">4. Terminology</a> <a href="#ref-for-public-key-credential-source①">(2)</a> <a href="#ref-for-public-key-credential-source②">(3)</a> <a href="#ref-for-public-key-credential-source③">(4)</a> <a href="#ref-for-public-key-credential-source④">(5)</a> <a href="#ref-for-public-key-credential-source⑤">(6)</a> <a href="#ref-for-public-key-credential-source⑥">(7)</a> <a href="#ref-for-public-key-credential-source⑦">(8)</a> <a href="#ref-for-public-key-credential-source⑧">(9)</a> <a href="#ref-for-public-key-credential-source⑨">(10)</a> <a href="#ref-for-public-key-credential-source①⓪">(11)</a> <a href="#ref-for-public-key-credential-source①①">(12)</a> <a href="#ref-for-public-key-credential-source①②">(13)</a> <a href="#ref-for-public-key-credential-source①③">(14)</a> <a href="#ref-for-public-key-credential-source①④">(15)</a> <a href="#ref-for-public-key-credential-source①⑤">(16)</a> <a href="#ref-for-public-key-credential-source①⑥">(17)</a> <a href="#ref-for-public-key-credential-source①⑦">(18)</a> <a href="#ref-for-public-key-credential-source①⑧">(19)</a> <a href="#ref-for-public-key-credential-source①⑨">(20)</a> <a href="#ref-for-public-key-credential-source②⓪">(21)</a> <a href="#ref-for-public-key-credential-source②①">(22)</a> <a href="#ref-for-public-key-credential-source②②">(23)</a> <a href="#ref-for-public-key-credential-source②③">(24)</a> <a href="#ref-for-public-key-credential-source②④">(25)</a> <a href="#ref-for-public-key-credential-source②⑤">(26)</a>
-    <li><a href="#ref-for-public-key-credential-source②⑥">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-public-key-credential-source②⑦">6. WebAuthn Authenticator Model</a>
-    <li><a href="#ref-for-public-key-credential-source②⑧">6.1. Authenticator Data</a> <a href="#ref-for-public-key-credential-source②⑨">(2)</a> <a href="#ref-for-public-key-credential-source③⓪">(3)</a> <a href="#ref-for-public-key-credential-source③①">(4)</a>
-    <li><a href="#ref-for-public-key-credential-source③②">6.1.3. Credential Backup State</a>
-    <li><a href="#ref-for-public-key-credential-source③③">6.2.2. Credential Storage Modality</a> <a href="#ref-for-public-key-credential-source③④">(2)</a>
-    <li><a href="#ref-for-public-key-credential-source③⑤">6.3.1. Lookup Credential Source by Credential ID Algorithm</a> <a href="#ref-for-public-key-credential-source③⑥">(2)</a>
-    <li><a href="#ref-for-public-key-credential-source③⑦">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-public-key-credential-source③⑧">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-public-key-credential-source③⑨">(2)</a>
-    <li><a href="#ref-for-public-key-credential-source④⓪">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-public-key-credential-source④①">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-public-key-credential-source④②">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source④③">(2)</a> <a href="#ref-for-public-key-credential-source④④">(3)</a>
-    <li><a href="#ref-for-public-key-credential-source④⑤">11.6. Get Credentials</a> <a href="#ref-for-public-key-credential-source④⑥">(2)</a>
-    <li><a href="#ref-for-public-key-credential-source④⑦">11.7. Remove Credential</a> <a href="#ref-for-public-key-credential-source④⑧">(2)</a> <a href="#ref-for-public-key-credential-source④⑨">(3)</a>
-    <li><a href="#ref-for-public-key-credential-source⑤⓪">11.8. Remove All Credentials</a> <a href="#ref-for-public-key-credential-source⑤①">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source">4. Terminology</a> <a href="#ref-for-public-key-credential-source①">(2)</a> <a href="#ref-for-public-key-credential-source②">(3)</a> <a href="#ref-for-public-key-credential-source③">(4)</a> <a href="#ref-for-public-key-credential-source④">(5)</a> <a href="#ref-for-public-key-credential-source⑤">(6)</a> <a href="#ref-for-public-key-credential-source⑥">(7)</a> <a href="#ref-for-public-key-credential-source⑦">(8)</a> <a href="#ref-for-public-key-credential-source⑧">(9)</a> <a href="#ref-for-public-key-credential-source⑨">(10)</a> <a href="#ref-for-public-key-credential-source①⓪">(11)</a> <a href="#ref-for-public-key-credential-source①①">(12)</a> <a href="#ref-for-public-key-credential-source①②">(13)</a> <a href="#ref-for-public-key-credential-source①③">(14)</a> <a href="#ref-for-public-key-credential-source①④">(15)</a> <a href="#ref-for-public-key-credential-source①⑤">(16)</a> <a href="#ref-for-public-key-credential-source①⑥">(17)</a> <a href="#ref-for-public-key-credential-source①⑦">(18)</a> <a href="#ref-for-public-key-credential-source①⑧">(19)</a> <a href="#ref-for-public-key-credential-source①⑨">(20)</a> <a href="#ref-for-public-key-credential-source②⓪">(21)</a> <a href="#ref-for-public-key-credential-source②①">(22)</a> <a href="#ref-for-public-key-credential-source②②">(23)</a> <a href="#ref-for-public-key-credential-source②③">(24)</a> <a href="#ref-for-public-key-credential-source②④">(25)</a> <a href="#ref-for-public-key-credential-source②⑤">(26)</a> <a href="#ref-for-public-key-credential-source②⑥">(27)</a> <a href="#ref-for-public-key-credential-source②⑦">(28)</a> <a href="#ref-for-public-key-credential-source②⑧">(29)</a> <a href="#ref-for-public-key-credential-source②⑨">(30)</a> <a href="#ref-for-public-key-credential-source③⓪">(31)</a> <a href="#ref-for-public-key-credential-source③①">(32)</a> <a href="#ref-for-public-key-credential-source③②">(33)</a> <a href="#ref-for-public-key-credential-source③③">(34)</a> <a href="#ref-for-public-key-credential-source③④">(35)</a> <a href="#ref-for-public-key-credential-source③⑤">(36)</a> <a href="#ref-for-public-key-credential-source③⑥">(37)</a>
+    <li><a href="#ref-for-public-key-credential-source③⑦">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-public-key-credential-source③⑧">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-public-key-credential-source③⑨">(2)</a> <a href="#ref-for-public-key-credential-source④⓪">(3)</a> <a href="#ref-for-public-key-credential-source④①">(4)</a> <a href="#ref-for-public-key-credential-source④②">(5)</a>
+    <li><a href="#ref-for-public-key-credential-source④③">6. WebAuthn Authenticator Model</a>
+    <li><a href="#ref-for-public-key-credential-source④④">6.1. Authenticator Data</a> <a href="#ref-for-public-key-credential-source④⑤">(2)</a> <a href="#ref-for-public-key-credential-source④⑥">(3)</a> <a href="#ref-for-public-key-credential-source④⑦">(4)</a>
+    <li><a href="#ref-for-public-key-credential-source④⑧">6.1.3. Credential Backup State</a>
+    <li><a href="#ref-for-public-key-credential-source④⑨">6.2.2. Credential Storage Modality</a> <a href="#ref-for-public-key-credential-source⑤⓪">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source⑤①">6.3.1. Lookup Credential Source by Credential ID Algorithm</a> <a href="#ref-for-public-key-credential-source⑤②">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source⑤③">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-public-key-credential-source⑤④">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-public-key-credential-source⑤⑤">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source⑤⑥">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-public-key-credential-source⑤⑦">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-public-key-credential-source⑤⑧">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source⑤⑨">(2)</a> <a href="#ref-for-public-key-credential-source⑥⓪">(3)</a>
+    <li><a href="#ref-for-public-key-credential-source⑥①">11.6. Get Credentials</a> <a href="#ref-for-public-key-credential-source⑥②">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source⑥③">11.7. Remove Credential</a> <a href="#ref-for-public-key-credential-source⑥④">(2)</a> <a href="#ref-for-public-key-credential-source⑥⑤">(3)</a>
+    <li><a href="#ref-for-public-key-credential-source⑥⑥">11.8. Remove All Credentials</a> <a href="#ref-for-public-key-credential-source⑥⑦">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source-type">
    <b><a href="#public-key-credential-source-type">#public-key-credential-source-type</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-public-key-credential-source-type">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-public-key-credential-source-type①">(2)</a>
-    <li><a href="#ref-for-public-key-credential-source-type②">11.5. Add Credential</a>
+    <li><a href="#ref-for-public-key-credential-source-type">4. Terminology</a>
+    <li><a href="#ref-for-public-key-credential-source-type①">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-public-key-credential-source-type②">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source-type③">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-public-key-credential-source-type④">11.5. Add Credential</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source-id">
@@ -10119,7 +11419,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-public-key-credential-source-id">6.3.1. Lookup Credential Source by Credential ID Algorithm</a> <a href="#ref-for-public-key-credential-source-id①">(2)</a>
     <li><a href="#ref-for-public-key-credential-source-id②">6.3.2. The authenticatorMakeCredential Operation</a>
     <li><a href="#ref-for-public-key-credential-source-id③">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-public-key-credential-source-id④">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source-id⑤">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source-id④">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-public-key-credential-source-id⑤">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source-id⑥">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source-privatekey">
@@ -10137,7 +11438,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-public-key-credential-source-rpid①">6. WebAuthn Authenticator Model</a>
     <li><a href="#ref-for-public-key-credential-source-rpid②">6.3.2. The authenticatorMakeCredential Operation</a>
     <li><a href="#ref-for-public-key-credential-source-rpid③">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-public-key-credential-source-rpid④">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source-rpid⑤">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source-rpid④">6.3.5. The silentCredentialDiscovery operation</a> <a href="#ref-for-public-key-credential-source-rpid⑤">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source-rpid⑥">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source-rpid⑦">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source-userhandle">
@@ -10146,7 +11448,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-public-key-credential-source-userhandle">6. WebAuthn Authenticator Model</a>
     <li><a href="#ref-for-public-key-credential-source-userhandle①">6.3.2. The authenticatorMakeCredential Operation</a>
     <li><a href="#ref-for-public-key-credential-source-userhandle②">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-public-key-credential-source-userhandle③">(2)</a>
-    <li><a href="#ref-for-public-key-credential-source-userhandle④">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source-userhandle⑤">(2)</a>
+    <li><a href="#ref-for-public-key-credential-source-userhandle④">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-public-key-credential-source-userhandle⑤">11.5. Add Credential</a> <a href="#ref-for-public-key-credential-source-userhandle⑥">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source-otherui">
@@ -10154,6 +11457,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-public-key-credential-source-otherui">4. Terminology</a> <a href="#ref-for-public-key-credential-source-otherui①">(2)</a>
     <li><a href="#ref-for-public-key-credential-source-otherui②">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-public-key-credential-source-otherui③">6.3.5. The silentCredentialDiscovery operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="public-key-credential-source-mutable-item">
@@ -10170,45 +11474,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-public-key-credential-source-managing-authenticator①①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="public-key-credential">
-   <b><a href="#public-key-credential">#public-key-credential</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-public-key-credential②">1. Introduction</a> <a href="#ref-for-public-key-credential③">(2)</a> <a href="#ref-for-public-key-credential④">(3)</a> <a href="#ref-for-public-key-credential⑤">(4)</a> <a href="#ref-for-public-key-credential⑥">(5)</a>
-    <li><a href="#ref-for-public-key-credential⑦">1.3. Sample API Usage Scenarios</a>
-    <li><a href="#ref-for-public-key-credential⑧">1.3.2. Registration Specifically with User-Verifying Platform Authenticator</a>
-    <li><a href="#ref-for-public-key-credential⑨">4. Terminology</a> <a href="#ref-for-public-key-credential①⓪">(2)</a> <a href="#ref-for-public-key-credential①①">(3)</a> <a href="#ref-for-public-key-credential①②">(4)</a> <a href="#ref-for-public-key-credential①③">(5)</a> <a href="#ref-for-public-key-credential①④">(6)</a> <a href="#ref-for-public-key-credential①⑤">(7)</a> <a href="#ref-for-public-key-credential①⑥">(8)</a> <a href="#ref-for-public-key-credential①⑦">(9)</a> <a href="#ref-for-public-key-credential①⑧">(10)</a> <a href="#ref-for-public-key-credential①⑨">(11)</a>
-    <li><a href="#ref-for-public-key-credential②⓪">5. Web Authentication API</a> <a href="#ref-for-public-key-credential②①">(2)</a> <a href="#ref-for-public-key-credential②②">(3)</a> <a href="#ref-for-public-key-credential②③">(4)</a>
-    <li><a href="#ref-for-public-key-credential②④">5.1. PublicKeyCredential Interface</a>
-    <li><a href="#ref-for-public-key-credential②⑤">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-public-key-credential②⑥">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
-    <li><a href="#ref-for-public-key-credential②⑦">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-public-key-credential②⑧">(2)</a> <a href="#ref-for-public-key-credential②⑨">(3)</a>
-    <li><a href="#ref-for-public-key-credential③⓪">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-public-key-credential③①">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
-    <li><a href="#ref-for-public-key-credential③②">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
-    <li><a href="#ref-for-public-key-credential③③">5.8. Supporting Data Structures</a>
-    <li><a href="#ref-for-public-key-credential③④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-public-key-credential③⑤">(2)</a> <a href="#ref-for-public-key-credential③⑥">(3)</a> <a href="#ref-for-public-key-credential③⑦">(4)</a>
-    <li><a href="#ref-for-public-key-credential③⑧">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
-    <li><a href="#ref-for-public-key-credential③⑨">6. WebAuthn Authenticator Model</a> <a href="#ref-for-public-key-credential④⓪">(2)</a>
-    <li><a href="#ref-for-public-key-credential④①">6.1. Authenticator Data</a> <a href="#ref-for-public-key-credential④②">(2)</a>
-    <li><a href="#ref-for-public-key-credential④③">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-public-key-credential④④">(2)</a> <a href="#ref-for-public-key-credential④⑤">(3)</a>
-    <li><a href="#ref-for-public-key-credential④⑥">6.2.2. Credential Storage Modality</a>
-    <li><a href="#ref-for-public-key-credential④⑦">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-public-key-credential④⑧">6.5. Attestation</a> <a href="#ref-for-public-key-credential④⑨">(2)</a>
-    <li><a href="#ref-for-public-key-credential⑤⓪">6.5.2. Attestation Statement Formats</a>
-    <li><a href="#ref-for-public-key-credential⑤①">6.5.3. Attestation Types</a>
-    <li><a href="#ref-for-public-key-credential⑤②">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-public-key-credential⑤③">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-public-key-credential⑤④">8.6. FIDO U2F Attestation Statement Format</a>
-    <li><a href="#ref-for-public-key-credential⑤⑤">9. WebAuthn Extensions</a> <a href="#ref-for-public-key-credential⑤⑥">(2)</a>
-    <li><a href="#ref-for-public-key-credential⑤⑦">13.4.4. Attestation Limitations</a>
-    <li><a href="#ref-for-public-key-credential⑤⑧">13.4.5. Revoked Attestation Certificates</a> <a href="#ref-for-public-key-credential⑤⑨">(2)</a>
-    <li><a href="#ref-for-public-key-credential⑥⓪">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-public-key-credential⑥①">(2)</a> <a href="#ref-for-public-key-credential⑥②">(3)</a> <a href="#ref-for-public-key-credential⑥③">(4)</a> <a href="#ref-for-public-key-credential⑥④">(5)</a>
-    <li><a href="#ref-for-public-key-credential⑥⑤">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-public-key-credential⑥⑥">(2)</a> <a href="#ref-for-public-key-credential⑥⑦">(3)</a> <a href="#ref-for-public-key-credential⑥⑧">(4)</a> <a href="#ref-for-public-key-credential⑥⑨">(5)</a> <a href="#ref-for-public-key-credential⑦⓪">(6)</a>
-    <li><a href="#ref-for-public-key-credential⑦①">14.3. Authenticator-local Biometric Recognition</a>
-    <li><a href="#ref-for-public-key-credential⑦②">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-public-key-credential⑦③">(2)</a> <a href="#ref-for-public-key-credential⑦④">(3)</a>
-    <li><a href="#ref-for-public-key-credential⑦⑤">14.5.2. Authentication Ceremony Privacy</a> <a href="#ref-for-public-key-credential⑦⑥">(2)</a> <a href="#ref-for-public-key-credential⑦⑦">(3)</a> <a href="#ref-for-public-key-credential⑦⑧">(4)</a> <a href="#ref-for-public-key-credential⑦⑨">(5)</a>
-   </ul>
-  </aside>
   <aside class="dfn-panel" data-for="rate-limiting">
    <b><a href="#rate-limiting">#rate-limiting</a></b><b>Referenced in:</b>
    <ul>
@@ -10220,30 +11485,30 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-registration">1. Introduction</a> <a href="#ref-for-registration①">(2)</a>
     <li><a href="#ref-for-registration②">1.1. Specification Roadmap</a>
-    <li><a href="#ref-for-registration③">4. Terminology</a> <a href="#ref-for-registration④">(2)</a> <a href="#ref-for-registration⑤">(3)</a> <a href="#ref-for-registration⑥">(4)</a> <a href="#ref-for-registration⑦">(5)</a> <a href="#ref-for-registration⑧">(6)</a> <a href="#ref-for-registration⑨">(7)</a> <a href="#ref-for-registration①⓪">(8)</a> <a href="#ref-for-registration①①">(9)</a> <a href="#ref-for-registration①②">(10)</a> <a href="#ref-for-registration①③">(11)</a>
-    <li><a href="#ref-for-registration①④">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-registration①⑤">6.2.3. Authentication Factor Capability</a>
-    <li><a href="#ref-for-registration①⑥">6.5. Attestation</a>
-    <li><a href="#ref-for-registration①⑦">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-registration①⑧">13. Security Considerations</a>
-    <li><a href="#ref-for-registration①⑨">13.4.5. Revoked Attestation Certificates</a> <a href="#ref-for-registration②⓪">(2)</a>
-    <li><a href="#ref-for-registration②①">14.1. De-anonymization Prevention Measures</a>
-    <li><a href="#ref-for-registration②②">14.3. Authenticator-local Biometric Recognition</a>
-    <li><a href="#ref-for-registration②③">15. Accessibility Considerations</a>
-    <li><a href="#ref-for-registration②④">16. Acknowledgements</a>
+    <li><a href="#ref-for-registration③">4. Terminology</a> <a href="#ref-for-registration④">(2)</a> <a href="#ref-for-registration⑤">(3)</a> <a href="#ref-for-registration⑥">(4)</a> <a href="#ref-for-registration⑦">(5)</a> <a href="#ref-for-registration⑧">(6)</a> <a href="#ref-for-registration⑨">(7)</a> <a href="#ref-for-registration①⓪">(8)</a> <a href="#ref-for-registration①①">(9)</a> <a href="#ref-for-registration①②">(10)</a> <a href="#ref-for-registration①③">(11)</a> <a href="#ref-for-registration①④">(12)</a> <a href="#ref-for-registration①⑤">(13)</a> <a href="#ref-for-registration①⑥">(14)</a>
+    <li><a href="#ref-for-registration①⑦">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-registration①⑧">6.2.3. Authentication Factor Capability</a>
+    <li><a href="#ref-for-registration①⑨">6.5. Attestation</a>
+    <li><a href="#ref-for-registration②⓪">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-registration②①">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-registration②②">(2)</a> <a href="#ref-for-registration②③">(3)</a> <a href="#ref-for-registration②④">(4)</a>
+    <li><a href="#ref-for-registration②⑤">13. Security Considerations</a>
+    <li><a href="#ref-for-registration②⑥">13.4.5. Revoked Attestation Certificates</a> <a href="#ref-for-registration②⑦">(2)</a>
+    <li><a href="#ref-for-registration②⑧">14.1. De-anonymization Prevention Measures</a>
+    <li><a href="#ref-for-registration②⑨">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-registration③⓪">15. Accessibility Considerations</a>
+    <li><a href="#ref-for-registration③①">16. Acknowledgements</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="registration-ceremony">
    <b><a href="#registration-ceremony">#registration-ceremony</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-registration-ceremony">4. Terminology</a> <a href="#ref-for-registration-ceremony①">(2)</a> <a href="#ref-for-registration-ceremony②">(3)</a>
-    <li><a href="#ref-for-registration-ceremony③">5.1. PublicKeyCredential Interface</a>
-    <li><a href="#ref-for-registration-ceremony④">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
-    <li><a href="#ref-for-registration-ceremony⑤">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-registration-ceremony">4. Terminology</a> <a href="#ref-for-registration-ceremony①">(2)</a> <a href="#ref-for-registration-ceremony②">(3)</a> <a href="#ref-for-registration-ceremony③">(4)</a>
+    <li><a href="#ref-for-registration-ceremony④">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-registration-ceremony⑤">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
     <li><a href="#ref-for-registration-ceremony⑥">6.1.3. Credential Backup State</a>
     <li><a href="#ref-for-registration-ceremony⑦">7. WebAuthn Relying Party Operations</a>
     <li><a href="#ref-for-registration-ceremony⑧">7.1. Registering a New Credential</a> <a href="#ref-for-registration-ceremony⑨">(2)</a> <a href="#ref-for-registration-ceremony①⓪">(3)</a> <a href="#ref-for-registration-ceremony①①">(4)</a>
-    <li><a href="#ref-for-registration-ceremony①②">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-registration-ceremony①③">(2)</a>
+    <li><a href="#ref-for-registration-ceremony①②">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-registration-ceremony①③">(2)</a>
     <li><a href="#ref-for-registration-ceremony①④">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
     <li><a href="#ref-for-registration-ceremony①⑤">13.4.4. Attestation Limitations</a>
     <li><a href="#ref-for-registration-ceremony①⑥">14.6.2. Username Enumeration</a> <a href="#ref-for-registration-ceremony①⑦">(2)</a> <a href="#ref-for-registration-ceremony①⑧">(3)</a> <a href="#ref-for-registration-ceremony①⑨">(4)</a> <a href="#ref-for-registration-ceremony②⓪">(5)</a>
@@ -10253,87 +11518,152 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="relying-party">
    <b><a href="#relying-party">#relying-party</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-relying-party①">1. Introduction</a> <a href="#ref-for-relying-party②">(2)</a> <a href="#ref-for-relying-party③">(3)</a> <a href="#ref-for-relying-party④">(4)</a> <a href="#ref-for-relying-party⑤">(5)</a> <a href="#ref-for-relying-party⑥">(6)</a> <a href="#ref-for-relying-party⑦">(7)</a>
-    <li><a href="#ref-for-relying-party⑧">1.1. Specification Roadmap</a> <a href="#ref-for-relying-party⑨">(2)</a> <a href="#ref-for-relying-party①⓪">(3)</a> <a href="#ref-for-relying-party①①">(4)</a> <a href="#ref-for-relying-party①②">(5)</a> <a href="#ref-for-relying-party①③">(6)</a> <a href="#ref-for-relying-party①④">(7)</a> <a href="#ref-for-relying-party①⑤">(8)</a>
-    <li><a href="#ref-for-relying-party①⑥">1.2.3. New Device Registration</a>
-    <li><a href="#ref-for-relying-party①⑦">1.2.4. Other Use Cases and Configurations</a>
-    <li><a href="#ref-for-relying-party①⑧">1.3.1. Registration</a> <a href="#ref-for-relying-party①⑨">(2)</a> <a href="#ref-for-relying-party②⓪">(3)</a> <a href="#ref-for-relying-party②①">(4)</a>
-    <li><a href="#ref-for-relying-party②②">1.3.2. Registration Specifically with User-Verifying Platform Authenticator</a> <a href="#ref-for-relying-party②③">(2)</a> <a href="#ref-for-relying-party②④">(3)</a>
-    <li><a href="#ref-for-relying-party②⑤">1.3.3. Authentication</a> <a href="#ref-for-relying-party②⑥">(2)</a> <a href="#ref-for-relying-party②⑦">(3)</a> <a href="#ref-for-relying-party②⑧">(4)</a> <a href="#ref-for-relying-party②⑨">(5)</a>
-    <li><a href="#ref-for-relying-party③⓪">1.3.5. Decommissioning</a> <a href="#ref-for-relying-party③①">(2)</a>
-    <li><a href="#ref-for-relying-party③②">2.1.1. Enumerations as DOMString types</a>
-    <li><a href="#ref-for-relying-party③③">4. Terminology</a> <a href="#ref-for-relying-party③④">(2)</a> <a href="#ref-for-relying-party③⑤">(3)</a> <a href="#ref-for-relying-party③⑥">(4)</a> <a href="#ref-for-relying-party③⑦">(5)</a> <a href="#ref-for-relying-party③⑧">(6)</a> <a href="#ref-for-relying-party③⑨">(7)</a> <a href="#ref-for-relying-party④⓪">(8)</a> <a href="#ref-for-relying-party④①">(9)</a> <a href="#ref-for-relying-party④②">(10)</a> <a href="#ref-for-relying-party④③">(11)</a> <a href="#ref-for-relying-party④④">(12)</a> <a href="#ref-for-relying-party④⑤">(13)</a> <a href="#ref-for-relying-party④⑥">(14)</a> <a href="#ref-for-relying-party④⑦">(15)</a> <a href="#ref-for-relying-party④⑧">(16)</a> <a href="#ref-for-relying-party④⑨">(17)</a> <a href="#ref-for-relying-party⑤⓪">(18)</a> <a href="#ref-for-relying-party⑤①">(19)</a> <a href="#ref-for-relying-party⑤②">(20)</a> <a href="#ref-for-relying-party⑤③">(21)</a> <a href="#ref-for-relying-party⑤④">(22)</a> <a href="#ref-for-relying-party⑤⑤">(23)</a> <a href="#ref-for-relying-party⑤⑥">(24)</a> <a href="#ref-for-relying-party⑤⑦">(25)</a> <a href="#ref-for-relying-party⑤⑧">(26)</a> <a href="#ref-for-relying-party⑤⑨">(27)</a> <a href="#ref-for-relying-party⑥⓪">(28)</a> <a href="#ref-for-relying-party⑥①">(29)</a> <a href="#ref-for-relying-party⑥②">(30)</a> <a href="#ref-for-relying-party⑥③">(31)</a> <a href="#ref-for-relying-party⑥④">(32)</a> <a href="#ref-for-relying-party⑥⑤">(33)</a> <a href="#ref-for-relying-party⑥⑥">(34)</a> <a href="#ref-for-relying-party⑥⑦">(35)</a> <a href="#ref-for-relying-party⑥⑧">(36)</a> <a href="#ref-for-relying-party⑥⑨">(37)</a> <a href="#ref-for-relying-party⑦⓪">(38)</a> <a href="#ref-for-relying-party⑦①">(39)</a>
-    <li><a href="#ref-for-relying-party⑦②">5. Web Authentication API</a> <a href="#ref-for-relying-party⑦③">(2)</a> <a href="#ref-for-relying-party⑦④">(3)</a> <a href="#ref-for-relying-party⑦⑤">(4)</a> <a href="#ref-for-relying-party⑦⑥">(5)</a> <a href="#ref-for-relying-party⑦⑦">(6)</a> <a href="#ref-for-relying-party⑦⑧">(7)</a>
-    <li><a href="#ref-for-relying-party⑦⑨">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-relying-party⑧⓪">(2)</a> <a href="#ref-for-relying-party⑧①">(3)</a> <a href="#ref-for-relying-party⑧②">(4)</a>
-    <li><a href="#ref-for-relying-party⑧③">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-relying-party⑧④">(2)</a> <a href="#ref-for-relying-party⑧⑤">(3)</a> <a href="#ref-for-relying-party⑧⑥">(4)</a>
-    <li><a href="#ref-for-relying-party⑧⑦">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-relying-party⑧⑧">(2)</a>
-    <li><a href="#ref-for-relying-party⑧⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-relying-party⑨⓪">(2)</a>
-    <li><a href="#ref-for-relying-party⑨①">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-relying-party⑨②">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
-    <li><a href="#ref-for-relying-party⑨③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-relying-party⑨④">(2)</a>
-    <li><a href="#ref-for-relying-party⑨⑤">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-relying-party⑨⑥">(2)</a> <a href="#ref-for-relying-party⑨⑦">(3)</a> <a href="#ref-for-relying-party⑨⑧">(4)</a> <a href="#ref-for-relying-party⑨⑨">(5)</a> <a href="#ref-for-relying-party①⓪⓪">(6)</a> <a href="#ref-for-relying-party①⓪①">(7)</a>
-    <li><a href="#ref-for-relying-party①⓪②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-relying-party①⓪③">(2)</a> <a href="#ref-for-relying-party①⓪④">(3)</a> <a href="#ref-for-relying-party①⓪⑤">(4)</a> <a href="#ref-for-relying-party①⓪⑥">(5)</a> <a href="#ref-for-relying-party①⓪⑦">(6)</a> <a href="#ref-for-relying-party①⓪⑧">(7)</a> <a href="#ref-for-relying-party①⓪⑨">(8)</a> <a href="#ref-for-relying-party①①⓪">(9)</a>
-    <li><a href="#ref-for-relying-party①①①">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-relying-party①①②">(2)</a> <a href="#ref-for-relying-party①①③">(3)</a> <a href="#ref-for-relying-party①①④">(4)</a> <a href="#ref-for-relying-party①①⑤">(5)</a> <a href="#ref-for-relying-party①①⑥">(6)</a>
-    <li><a href="#ref-for-relying-party①①⑦">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> <a href="#ref-for-relying-party①①⑧">(2)</a>
-    <li><a href="#ref-for-relying-party①①⑨">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-relying-party①②⓪">(2)</a> <a href="#ref-for-relying-party①②①">(3)</a> <a href="#ref-for-relying-party①②②">(4)</a>
-    <li><a href="#ref-for-relying-party①②③">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-relying-party①②④">(2)</a> <a href="#ref-for-relying-party①②⑤">(3)</a>
-    <li><a href="#ref-for-relying-party①②⑥">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a> <a href="#ref-for-relying-party①②⑦">(2)</a> <a href="#ref-for-relying-party①②⑧">(3)</a>
-    <li><a href="#ref-for-relying-party①②⑨">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-relying-party①③⓪">(2)</a> <a href="#ref-for-relying-party①③①">(3)</a> <a href="#ref-for-relying-party①③②">(4)</a> <a href="#ref-for-relying-party①③③">(5)</a> <a href="#ref-for-relying-party①③④">(6)</a>
-    <li><a href="#ref-for-relying-party①③⑤">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-relying-party①③⑥">(2)</a> <a href="#ref-for-relying-party①③⑦">(3)</a> <a href="#ref-for-relying-party①③⑧">(4)</a> <a href="#ref-for-relying-party①③⑨">(5)</a> <a href="#ref-for-relying-party①④⓪">(6)</a> <a href="#ref-for-relying-party①④①">(7)</a> <a href="#ref-for-relying-party①④②">(8)</a>
-    <li><a href="#ref-for-relying-party①④③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-relying-party①④④">(2)</a> <a href="#ref-for-relying-party①④⑤">(3)</a> <a href="#ref-for-relying-party①④⑥">(4)</a> <a href="#ref-for-relying-party①④⑦">(5)</a> <a href="#ref-for-relying-party①④⑧">(6)</a> <a href="#ref-for-relying-party①④⑨">(7)</a> <a href="#ref-for-relying-party①⑤⓪">(8)</a> <a href="#ref-for-relying-party①⑤①">(9)</a>
-    <li><a href="#ref-for-relying-party①⑤②">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
-    <li><a href="#ref-for-relying-party①⑤③">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-relying-party①⑤④">(2)</a> <a href="#ref-for-relying-party①⑤⑤">(3)</a> <a href="#ref-for-relying-party①⑤⑥">(4)</a> <a href="#ref-for-relying-party①⑤⑦">(5)</a>
-    <li><a href="#ref-for-relying-party①⑤⑧">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-relying-party①⑤⑨">(2)</a>
-    <li><a href="#ref-for-relying-party①⑥⓪">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
-    <li><a href="#ref-for-relying-party①⑥①">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-relying-party①⑥②">(2)</a> <a href="#ref-for-relying-party①⑥③">(3)</a>
-    <li><a href="#ref-for-relying-party①⑥④">5.10. Using Web Authentication within iframe elements</a>
-    <li><a href="#ref-for-relying-party①⑥⑤">6. WebAuthn Authenticator Model</a> <a href="#ref-for-relying-party①⑥⑥">(2)</a> <a href="#ref-for-relying-party①⑥⑦">(3)</a> <a href="#ref-for-relying-party①⑥⑧">(4)</a>
-    <li><a href="#ref-for-relying-party①⑥⑨">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-relying-party①⑦⓪">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-relying-party①⑦①">(2)</a> <a href="#ref-for-relying-party①⑦②">(3)</a> <a href="#ref-for-relying-party①⑦③">(4)</a> <a href="#ref-for-relying-party①⑦④">(5)</a>
-    <li><a href="#ref-for-relying-party①⑦⑤">6.1.3. Credential Backup State</a> <a href="#ref-for-relying-party①⑦⑥">(2)</a> <a href="#ref-for-relying-party①⑦⑦">(3)</a> <a href="#ref-for-relying-party①⑦⑧">(4)</a> <a href="#ref-for-relying-party①⑦⑨">(5)</a>
-    <li><a href="#ref-for-relying-party①⑧⓪">6.2. Authenticator Taxonomy</a>
-    <li><a href="#ref-for-relying-party①⑧①">6.2.2. Credential Storage Modality</a> <a href="#ref-for-relying-party①⑧②">(2)</a> <a href="#ref-for-relying-party①⑧③">(3)</a>
-    <li><a href="#ref-for-relying-party①⑧④">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-relying-party①⑧⑤">(2)</a> <a href="#ref-for-relying-party①⑧⑥">(3)</a>
-    <li><a href="#ref-for-relying-party①⑧⑦">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-relying-party①⑧⑧">(2)</a> <a href="#ref-for-relying-party①⑧⑨">(3)</a> <a href="#ref-for-relying-party①⑨⓪">(4)</a> <a href="#ref-for-relying-party①⑨①">(5)</a> <a href="#ref-for-relying-party①⑨②">(6)</a>
-    <li><a href="#ref-for-relying-party①⑨③">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-relying-party①⑨④">(2)</a> <a href="#ref-for-relying-party①⑨⑤">(3)</a>
-    <li><a href="#ref-for-relying-party①⑨⑥">6.4. String Handling</a>
-    <li><a href="#ref-for-relying-party①⑨⑦">6.4.1. String Truncation</a> <a href="#ref-for-relying-party①⑨⑧">(2)</a>
-    <li><a href="#ref-for-relying-party①⑨⑨">6.5. Attestation</a> <a href="#ref-for-relying-party②⓪⓪">(2)</a> <a href="#ref-for-relying-party②⓪①">(3)</a> <a href="#ref-for-relying-party②⓪②">(4)</a> <a href="#ref-for-relying-party②⓪③">(5)</a> <a href="#ref-for-relying-party②⓪④">(6)</a> <a href="#ref-for-relying-party②⓪⑤">(7)</a> <a href="#ref-for-relying-party②⓪⑥">(8)</a>
-    <li><a href="#ref-for-relying-party②⓪⑦">6.5.3. Attestation Types</a> <a href="#ref-for-relying-party②⓪⑧">(2)</a> <a href="#ref-for-relying-party②⓪⑨">(3)</a> <a href="#ref-for-relying-party②①⓪">(4)</a> <a href="#ref-for-relying-party②①①">(5)</a>
-    <li><a href="#ref-for-relying-party②①②">7. WebAuthn Relying Party Operations</a> <a href="#ref-for-relying-party②①③">(2)</a> <a href="#ref-for-relying-party②①④">(3)</a> <a href="#ref-for-relying-party②①⑤">(4)</a>
-    <li><a href="#ref-for-relying-party②①⑥">7.1. Registering a New Credential</a> <a href="#ref-for-relying-party②①⑦">(2)</a> <a href="#ref-for-relying-party②①⑧">(3)</a> <a href="#ref-for-relying-party②①⑨">(4)</a> <a href="#ref-for-relying-party②②⓪">(5)</a> <a href="#ref-for-relying-party②②①">(6)</a> <a href="#ref-for-relying-party②②②">(7)</a> <a href="#ref-for-relying-party②②③">(8)</a> <a href="#ref-for-relying-party②②④">(9)</a> <a href="#ref-for-relying-party②②⑤">(10)</a> <a href="#ref-for-relying-party②②⑥">(11)</a> <a href="#ref-for-relying-party②②⑦">(12)</a> <a href="#ref-for-relying-party②②⑧">(13)</a> <a href="#ref-for-relying-party②②⑨">(14)</a> <a href="#ref-for-relying-party②③⓪">(15)</a> <a href="#ref-for-relying-party②③①">(16)</a> <a href="#ref-for-relying-party②③②">(17)</a> <a href="#ref-for-relying-party②③③">(18)</a> <a href="#ref-for-relying-party②③④">(19)</a> <a href="#ref-for-relying-party②③⑤">(20)</a> <a href="#ref-for-relying-party②③⑥">(21)</a> <a href="#ref-for-relying-party②③⑦">(22)</a> <a href="#ref-for-relying-party②③⑧">(23)</a> <a href="#ref-for-relying-party②③⑨">(24)</a>
-    <li><a href="#ref-for-relying-party②④⓪">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-relying-party②④①">(2)</a> <a href="#ref-for-relying-party②④②">(3)</a> <a href="#ref-for-relying-party②④③">(4)</a> <a href="#ref-for-relying-party②④④">(5)</a> <a href="#ref-for-relying-party②④⑤">(6)</a> <a href="#ref-for-relying-party②④⑥">(7)</a> <a href="#ref-for-relying-party②④⑦">(8)</a> <a href="#ref-for-relying-party②④⑧">(9)</a> <a href="#ref-for-relying-party②④⑨">(10)</a> <a href="#ref-for-relying-party②⑤⓪">(11)</a> <a href="#ref-for-relying-party②⑤①">(12)</a> <a href="#ref-for-relying-party②⑤②">(13)</a>
-    <li><a href="#ref-for-relying-party②⑤③">9. WebAuthn Extensions</a> <a href="#ref-for-relying-party②⑤④">(2)</a> <a href="#ref-for-relying-party②⑤⑤">(3)</a>
-    <li><a href="#ref-for-relying-party②⑤⑥">9.2. Defining Extensions</a>
-    <li><a href="#ref-for-relying-party②⑤⑦">9.3. Extending Request Parameters</a> <a href="#ref-for-relying-party②⑤⑧">(2)</a> <a href="#ref-for-relying-party②⑤⑨">(3)</a>
-    <li><a href="#ref-for-relying-party②⑥⓪">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-relying-party②⑥①">(2)</a> <a href="#ref-for-relying-party②⑥②">(3)</a> <a href="#ref-for-relying-party②⑥③">(4)</a> <a href="#ref-for-relying-party②⑥④">(5)</a>
-    <li><a href="#ref-for-relying-party②⑥⑤">10.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-relying-party②⑥⑥">(2)</a>
-    <li><a href="#ref-for-relying-party②⑥⑦">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-relying-party②⑥⑧">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-relying-party②⑥⑨">(2)</a>
-    <li><a href="#ref-for-relying-party②⑦⓪">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-relying-party②⑦①">(2)</a> <a href="#ref-for-relying-party②⑦②">(3)</a> <a href="#ref-for-relying-party②⑦③">(4)</a> <a href="#ref-for-relying-party②⑦④">(5)</a> <a href="#ref-for-relying-party②⑦⑤">(6)</a> <a href="#ref-for-relying-party②⑦⑥">(7)</a> <a href="#ref-for-relying-party②⑦⑦">(8)</a>
-    <li><a href="#ref-for-relying-party②⑦⑧">12.4. WebAuthn Extension Identifier Registrations</a>
-    <li><a href="#ref-for-relying-party②⑦⑨">13. Security Considerations</a> <a href="#ref-for-relying-party②⑧⓪">(2)</a> <a href="#ref-for-relying-party②⑧①">(3)</a> <a href="#ref-for-relying-party②⑧②">(4)</a>
-    <li><a href="#ref-for-relying-party②⑧③">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-relying-party②⑧④">(2)</a>
-    <li><a href="#ref-for-relying-party②⑧⑤">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a> <a href="#ref-for-relying-party②⑧⑥">(2)</a>
-    <li><a href="#ref-for-relying-party②⑧⑦">13.4. Security considerations for Relying Parties</a>
-    <li><a href="#ref-for-relying-party②⑧⑧">13.4.1. Security Benefits for WebAuthn Relying Parties</a> <a href="#ref-for-relying-party②⑧⑨">(2)</a> <a href="#ref-for-relying-party②⑨⓪">(3)</a> <a href="#ref-for-relying-party②⑨①">(4)</a> <a href="#ref-for-relying-party②⑨②">(5)</a> <a href="#ref-for-relying-party②⑨③">(6)</a>
-    <li><a href="#ref-for-relying-party②⑨④">13.4.2. Visibility Considerations for Embedded Usage</a> <a href="#ref-for-relying-party②⑨⑤">(2)</a> <a href="#ref-for-relying-party②⑨⑥">(3)</a> <a href="#ref-for-relying-party②⑨⑦">(4)</a>
-    <li><a href="#ref-for-relying-party②⑨⑧">13.4.3. Cryptographic Challenges</a>
-    <li><a href="#ref-for-relying-party②⑨⑨">13.4.4. Attestation Limitations</a> <a href="#ref-for-relying-party③⓪⓪">(2)</a> <a href="#ref-for-relying-party③⓪①">(3)</a> <a href="#ref-for-relying-party③⓪②">(4)</a> <a href="#ref-for-relying-party③⓪③">(5)</a> <a href="#ref-for-relying-party③⓪④">(6)</a> <a href="#ref-for-relying-party③⓪⑤">(7)</a> <a href="#ref-for-relying-party③⓪⑥">(8)</a>
-    <li><a href="#ref-for-relying-party③⓪⑦">13.4.5. Revoked Attestation Certificates</a> <a href="#ref-for-relying-party③⓪⑧">(2)</a> <a href="#ref-for-relying-party③⓪⑨">(3)</a>
-    <li><a href="#ref-for-relying-party③①⓪">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-relying-party③①①">(2)</a> <a href="#ref-for-relying-party③①②">(3)</a>
-    <li><a href="#ref-for-relying-party③①③">13.4.7. Unprotected account detection</a> <a href="#ref-for-relying-party③①④">(2)</a>
-    <li><a href="#ref-for-relying-party③①⑤">14. Privacy Considerations</a>
-    <li><a href="#ref-for-relying-party③①⑥">14.1. De-anonymization Prevention Measures</a> <a href="#ref-for-relying-party③①⑦">(2)</a> <a href="#ref-for-relying-party③①⑧">(3)</a> <a href="#ref-for-relying-party③①⑨">(4)</a> <a href="#ref-for-relying-party③②⓪">(5)</a> <a href="#ref-for-relying-party③②①">(6)</a> <a href="#ref-for-relying-party③②②">(7)</a>
-    <li><a href="#ref-for-relying-party③②③">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-relying-party③②④">(2)</a> <a href="#ref-for-relying-party③②⑤">(3)</a> <a href="#ref-for-relying-party③②⑥">(4)</a> <a href="#ref-for-relying-party③②⑦">(5)</a> <a href="#ref-for-relying-party③②⑧">(6)</a> <a href="#ref-for-relying-party③②⑨">(7)</a> <a href="#ref-for-relying-party③③⓪">(8)</a> <a href="#ref-for-relying-party③③①">(9)</a> <a href="#ref-for-relying-party③③②">(10)</a> <a href="#ref-for-relying-party③③③">(11)</a>
-    <li><a href="#ref-for-relying-party③③④">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-relying-party③③⑤">(2)</a> <a href="#ref-for-relying-party③③⑥">(3)</a> <a href="#ref-for-relying-party③③⑦">(4)</a> <a href="#ref-for-relying-party③③⑧">(5)</a>
-    <li><a href="#ref-for-relying-party③③⑨">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-relying-party③④⓪">(2)</a> <a href="#ref-for-relying-party③④①">(3)</a>
-    <li><a href="#ref-for-relying-party③④②">14.5.2. Authentication Ceremony Privacy</a> <a href="#ref-for-relying-party③④③">(2)</a> <a href="#ref-for-relying-party③④④">(3)</a>
-    <li><a href="#ref-for-relying-party③④⑤">14.6. Privacy considerations for Relying Parties</a>
-    <li><a href="#ref-for-relying-party③④⑥">14.6.1. User Handle Contents</a> <a href="#ref-for-relying-party③④⑦">(2)</a>
-    <li><a href="#ref-for-relying-party③④⑧">14.6.2. Username Enumeration</a> <a href="#ref-for-relying-party③④⑨">(2)</a> <a href="#ref-for-relying-party③⑤⓪">(3)</a> <a href="#ref-for-relying-party③⑤①">(4)</a> <a href="#ref-for-relying-party③⑤②">(5)</a> <a href="#ref-for-relying-party③⑤③">(6)</a> <a href="#ref-for-relying-party③⑤④">(7)</a> <a href="#ref-for-relying-party③⑤⑤">(8)</a> <a href="#ref-for-relying-party③⑤⑥">(9)</a> <a href="#ref-for-relying-party③⑤⑦">(10)</a> <a href="#ref-for-relying-party③⑤⑧">(11)</a> <a href="#ref-for-relying-party③⑤⑨">(12)</a>
-    <li><a href="#ref-for-relying-party③⑥⓪">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-relying-party③⑥①">(2)</a> <a href="#ref-for-relying-party③⑥②">(3)</a> <a href="#ref-for-relying-party③⑥③">(4)</a> <a href="#ref-for-relying-party③⑥④">(5)</a>
-    <li><a href="#ref-for-relying-party③⑥⑤">15. Accessibility Considerations</a> <a href="#ref-for-relying-party③⑥⑥">(2)</a>
+    <li><a href="#ref-for-relying-party①">1. Introduction</a> <a href="#ref-for-relying-party②">(2)</a> <a href="#ref-for-relying-party③">(3)</a> <a href="#ref-for-relying-party④">(4)</a> <a href="#ref-for-relying-party⑤">(5)</a> <a href="#ref-for-relying-party⑥">(6)</a> <a href="#ref-for-relying-party⑦">(7)</a>
+    <li><a href="#ref-for-relying-party⑧">1.1. Specification Roadmap</a> <a href="#ref-for-relying-party⑨">(2)</a> <a href="#ref-for-relying-party①⓪">(3)</a> <a href="#ref-for-relying-party①①">(4)</a> <a href="#ref-for-relying-party①②">(5)</a> <a href="#ref-for-relying-party①③">(6)</a> <a href="#ref-for-relying-party①④">(7)</a> <a href="#ref-for-relying-party①⑤">(8)</a>
+    <li><a href="#ref-for-relying-party①⑥">1.2.3. New Device Registration</a>
+    <li><a href="#ref-for-relying-party①⑦">1.2.4. Other Use Cases and Configurations</a>
+    <li><a href="#ref-for-relying-party①⑧">1.3.1. Registration</a> <a href="#ref-for-relying-party①⑨">(2)</a> <a href="#ref-for-relying-party②⓪">(3)</a> <a href="#ref-for-relying-party②①">(4)</a>
+    <li><a href="#ref-for-relying-party②②">1.3.2. Registration Specifically with User-Verifying Platform Authenticator</a> <a href="#ref-for-relying-party②③">(2)</a> <a href="#ref-for-relying-party②④">(3)</a>
+    <li><a href="#ref-for-relying-party②⑤">1.3.3. Authentication</a> <a href="#ref-for-relying-party②⑥">(2)</a> <a href="#ref-for-relying-party②⑦">(3)</a> <a href="#ref-for-relying-party②⑧">(4)</a> <a href="#ref-for-relying-party②⑨">(5)</a>
+    <li><a href="#ref-for-relying-party③⓪">1.3.5. Decommissioning</a> <a href="#ref-for-relying-party③①">(2)</a>
+    <li><a href="#ref-for-relying-party③②">2.1.1. Enumerations as DOMString types</a>
+    <li><a href="#ref-for-relying-party③③">4. Terminology</a> <a href="#ref-for-relying-party③④">(2)</a> <a href="#ref-for-relying-party③⑤">(3)</a> <a href="#ref-for-relying-party③⑥">(4)</a> <a href="#ref-for-relying-party③⑦">(5)</a> <a href="#ref-for-relying-party③⑧">(6)</a> <a href="#ref-for-relying-party③⑨">(7)</a> <a href="#ref-for-relying-party④⓪">(8)</a> <a href="#ref-for-relying-party④①">(9)</a> <a href="#ref-for-relying-party④②">(10)</a> <a href="#ref-for-relying-party④③">(11)</a> <a href="#ref-for-relying-party④④">(12)</a> <a href="#ref-for-relying-party④⑤">(13)</a> <a href="#ref-for-relying-party④⑥">(14)</a> <a href="#ref-for-relying-party④⑦">(15)</a> <a href="#ref-for-relying-party④⑧">(16)</a> <a href="#ref-for-relying-party④⑨">(17)</a> <a href="#ref-for-relying-party⑤⓪">(18)</a> <a href="#ref-for-relying-party⑤①">(19)</a> <a href="#ref-for-relying-party⑤②">(20)</a> <a href="#ref-for-relying-party⑤③">(21)</a> <a href="#ref-for-relying-party⑤④">(22)</a> <a href="#ref-for-relying-party⑤⑤">(23)</a> <a href="#ref-for-relying-party⑤⑥">(24)</a> <a href="#ref-for-relying-party⑤⑦">(25)</a> <a href="#ref-for-relying-party⑤⑧">(26)</a> <a href="#ref-for-relying-party⑤⑨">(27)</a> <a href="#ref-for-relying-party⑥⓪">(28)</a> <a href="#ref-for-relying-party⑥①">(29)</a> <a href="#ref-for-relying-party⑥②">(30)</a> <a href="#ref-for-relying-party⑥③">(31)</a> <a href="#ref-for-relying-party⑥④">(32)</a> <a href="#ref-for-relying-party⑥⑤">(33)</a> <a href="#ref-for-relying-party⑥⑥">(34)</a> <a href="#ref-for-relying-party⑥⑦">(35)</a> <a href="#ref-for-relying-party⑥⑧">(36)</a> <a href="#ref-for-relying-party⑥⑨">(37)</a> <a href="#ref-for-relying-party⑦⓪">(38)</a> <a href="#ref-for-relying-party⑦①">(39)</a> <a href="#ref-for-relying-party⑦②">(40)</a> <a href="#ref-for-relying-party⑦③">(41)</a> <a href="#ref-for-relying-party⑦④">(42)</a> <a href="#ref-for-relying-party⑦⑤">(43)</a> <a href="#ref-for-relying-party⑦⑥">(44)</a>
+    <li><a href="#ref-for-relying-party⑦⑦">5. Web Authentication API</a> <a href="#ref-for-relying-party⑦⑧">(2)</a> <a href="#ref-for-relying-party⑦⑨">(3)</a> <a href="#ref-for-relying-party⑧⓪">(4)</a> <a href="#ref-for-relying-party⑧①">(5)</a> <a href="#ref-for-relying-party⑧②">(6)</a> <a href="#ref-for-relying-party⑧③">(7)</a>
+    <li><a href="#ref-for-relying-party⑧④">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-relying-party⑧⑤">(2)</a> <a href="#ref-for-relying-party⑧⑥">(3)</a> <a href="#ref-for-relying-party⑧⑦">(4)</a> <a href="#ref-for-relying-party⑧⑧">(5)</a>
+    <li><a href="#ref-for-relying-party⑧⑨">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-relying-party⑨⓪">(2)</a> <a href="#ref-for-relying-party⑨①">(3)</a> <a href="#ref-for-relying-party⑨②">(4)</a>
+    <li><a href="#ref-for-relying-party⑨③">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a> <a href="#ref-for-relying-party⑨④">(2)</a> <a href="#ref-for-relying-party⑨⑤">(3)</a> <a href="#ref-for-relying-party⑨⑥">(4)</a>
+    <li><a href="#ref-for-relying-party⑨⑦">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-relying-party⑨⑧">(2)</a>
+    <li><a href="#ref-for-relying-party⑨⑨">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-relying-party①⓪⓪">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
+    <li><a href="#ref-for-relying-party①⓪①">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-relying-party①⓪②">(2)</a>
+    <li><a href="#ref-for-relying-party①⓪③">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-relying-party①⓪④">(2)</a> <a href="#ref-for-relying-party①⓪⑤">(3)</a> <a href="#ref-for-relying-party①⓪⑥">(4)</a> <a href="#ref-for-relying-party①⓪⑦">(5)</a> <a href="#ref-for-relying-party①⓪⑧">(6)</a> <a href="#ref-for-relying-party①⓪⑨">(7)</a>
+    <li><a href="#ref-for-relying-party①①⓪">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-relying-party①①①">(2)</a> <a href="#ref-for-relying-party①①②">(3)</a> <a href="#ref-for-relying-party①①③">(4)</a> <a href="#ref-for-relying-party①①④">(5)</a> <a href="#ref-for-relying-party①①⑤">(6)</a> <a href="#ref-for-relying-party①①⑥">(7)</a> <a href="#ref-for-relying-party①①⑦">(8)</a> <a href="#ref-for-relying-party①①⑧">(9)</a>
+    <li><a href="#ref-for-relying-party①①⑨">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-relying-party①②⓪">(2)</a> <a href="#ref-for-relying-party①②①">(3)</a> <a href="#ref-for-relying-party①②②">(4)</a> <a href="#ref-for-relying-party①②③">(5)</a> <a href="#ref-for-relying-party①②④">(6)</a>
+    <li><a href="#ref-for-relying-party①②⑤">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> <a href="#ref-for-relying-party①②⑥">(2)</a>
+    <li><a href="#ref-for-relying-party①②⑦">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-relying-party①②⑧">(2)</a> <a href="#ref-for-relying-party①②⑨">(3)</a> <a href="#ref-for-relying-party①③⓪">(4)</a>
+    <li><a href="#ref-for-relying-party①③①">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-relying-party①③②">(2)</a> <a href="#ref-for-relying-party①③③">(3)</a>
+    <li><a href="#ref-for-relying-party①③④">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a> <a href="#ref-for-relying-party①③⑤">(2)</a> <a href="#ref-for-relying-party①③⑥">(3)</a>
+    <li><a href="#ref-for-relying-party①③⑦">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-relying-party①③⑧">(2)</a> <a href="#ref-for-relying-party①③⑨">(3)</a> <a href="#ref-for-relying-party①④⓪">(4)</a> <a href="#ref-for-relying-party①④①">(5)</a> <a href="#ref-for-relying-party①④②">(6)</a>
+    <li><a href="#ref-for-relying-party①④③">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-relying-party①④④">(2)</a> <a href="#ref-for-relying-party①④⑤">(3)</a> <a href="#ref-for-relying-party①④⑥">(4)</a> <a href="#ref-for-relying-party①④⑦">(5)</a> <a href="#ref-for-relying-party①④⑧">(6)</a> <a href="#ref-for-relying-party①④⑨">(7)</a> <a href="#ref-for-relying-party①⑤⓪">(8)</a>
+    <li><a href="#ref-for-relying-party①⑤①">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-relying-party①⑤②">(2)</a> <a href="#ref-for-relying-party①⑤③">(3)</a> <a href="#ref-for-relying-party①⑤④">(4)</a> <a href="#ref-for-relying-party①⑤⑤">(5)</a> <a href="#ref-for-relying-party①⑤⑥">(6)</a> <a href="#ref-for-relying-party①⑤⑦">(7)</a> <a href="#ref-for-relying-party①⑤⑧">(8)</a> <a href="#ref-for-relying-party①⑤⑨">(9)</a>
+    <li><a href="#ref-for-relying-party①⑥⓪">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
+    <li><a href="#ref-for-relying-party①⑥①">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a> <a href="#ref-for-relying-party①⑥②">(2)</a> <a href="#ref-for-relying-party①⑥③">(3)</a> <a href="#ref-for-relying-party①⑥④">(4)</a> <a href="#ref-for-relying-party①⑥⑤">(5)</a>
+    <li><a href="#ref-for-relying-party①⑥⑥">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-relying-party①⑥⑦">(2)</a>
+    <li><a href="#ref-for-relying-party①⑥⑧">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
+    <li><a href="#ref-for-relying-party①⑥⑨">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-relying-party①⑦⓪">(2)</a> <a href="#ref-for-relying-party①⑦①">(3)</a>
+    <li><a href="#ref-for-relying-party①⑦②">5.10. Using Web Authentication within iframe elements</a>
+    <li><a href="#ref-for-relying-party①⑦③">6. WebAuthn Authenticator Model</a> <a href="#ref-for-relying-party①⑦④">(2)</a> <a href="#ref-for-relying-party①⑦⑤">(3)</a> <a href="#ref-for-relying-party①⑦⑥">(4)</a>
+    <li><a href="#ref-for-relying-party①⑦⑦">6.1. Authenticator Data</a>
+    <li><a href="#ref-for-relying-party①⑦⑧">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-relying-party①⑦⑨">(2)</a> <a href="#ref-for-relying-party①⑧⓪">(3)</a> <a href="#ref-for-relying-party①⑧①">(4)</a> <a href="#ref-for-relying-party①⑧②">(5)</a>
+    <li><a href="#ref-for-relying-party①⑧③">6.1.3. Credential Backup State</a> <a href="#ref-for-relying-party①⑧④">(2)</a> <a href="#ref-for-relying-party①⑧⑤">(3)</a> <a href="#ref-for-relying-party①⑧⑥">(4)</a> <a href="#ref-for-relying-party①⑧⑦">(5)</a>
+    <li><a href="#ref-for-relying-party①⑧⑧">6.2. Authenticator Taxonomy</a>
+    <li><a href="#ref-for-relying-party①⑧⑨">6.2.2. Credential Storage Modality</a> <a href="#ref-for-relying-party①⑨⓪">(2)</a> <a href="#ref-for-relying-party①⑨①">(3)</a>
+    <li><a href="#ref-for-relying-party①⑨②">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-relying-party①⑨③">(2)</a> <a href="#ref-for-relying-party①⑨④">(3)</a>
+    <li><a href="#ref-for-relying-party①⑨⑤">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-relying-party①⑨⑥">(2)</a> <a href="#ref-for-relying-party①⑨⑦">(3)</a> <a href="#ref-for-relying-party①⑨⑧">(4)</a> <a href="#ref-for-relying-party①⑨⑨">(5)</a> <a href="#ref-for-relying-party②⓪⓪">(6)</a>
+    <li><a href="#ref-for-relying-party②⓪①">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-relying-party②⓪②">(2)</a> <a href="#ref-for-relying-party②⓪③">(3)</a>
+    <li><a href="#ref-for-relying-party②⓪④">6.4. String Handling</a>
+    <li><a href="#ref-for-relying-party②⓪⑤">6.4.1. String Truncation</a> <a href="#ref-for-relying-party②⓪⑥">(2)</a>
+    <li><a href="#ref-for-relying-party②⓪⑦">6.5. Attestation</a> <a href="#ref-for-relying-party②⓪⑧">(2)</a> <a href="#ref-for-relying-party②⓪⑨">(3)</a> <a href="#ref-for-relying-party②①⓪">(4)</a> <a href="#ref-for-relying-party②①①">(5)</a> <a href="#ref-for-relying-party②①②">(6)</a> <a href="#ref-for-relying-party②①③">(7)</a> <a href="#ref-for-relying-party②①④">(8)</a>
+    <li><a href="#ref-for-relying-party②①⑤">6.5.3. Attestation Types</a> <a href="#ref-for-relying-party②①⑥">(2)</a> <a href="#ref-for-relying-party②①⑦">(3)</a> <a href="#ref-for-relying-party②①⑧">(4)</a> <a href="#ref-for-relying-party②①⑨">(5)</a>
+    <li><a href="#ref-for-relying-party②②⓪">7. WebAuthn Relying Party Operations</a> <a href="#ref-for-relying-party②②①">(2)</a> <a href="#ref-for-relying-party②②②">(3)</a> <a href="#ref-for-relying-party②②③">(4)</a>
+    <li><a href="#ref-for-relying-party②②④">7.1. Registering a New Credential</a> <a href="#ref-for-relying-party②②⑤">(2)</a> <a href="#ref-for-relying-party②②⑥">(3)</a> <a href="#ref-for-relying-party②②⑦">(4)</a> <a href="#ref-for-relying-party②②⑧">(5)</a> <a href="#ref-for-relying-party②②⑨">(6)</a> <a href="#ref-for-relying-party②③⓪">(7)</a> <a href="#ref-for-relying-party②③①">(8)</a> <a href="#ref-for-relying-party②③②">(9)</a> <a href="#ref-for-relying-party②③③">(10)</a> <a href="#ref-for-relying-party②③④">(11)</a> <a href="#ref-for-relying-party②③⑤">(12)</a> <a href="#ref-for-relying-party②③⑥">(13)</a> <a href="#ref-for-relying-party②③⑦">(14)</a> <a href="#ref-for-relying-party②③⑧">(15)</a> <a href="#ref-for-relying-party②③⑨">(16)</a> <a href="#ref-for-relying-party②④⓪">(17)</a> <a href="#ref-for-relying-party②④①">(18)</a> <a href="#ref-for-relying-party②④②">(19)</a> <a href="#ref-for-relying-party②④③">(20)</a> <a href="#ref-for-relying-party②④④">(21)</a> <a href="#ref-for-relying-party②④⑤">(22)</a> <a href="#ref-for-relying-party②④⑥">(23)</a> <a href="#ref-for-relying-party②④⑦">(24)</a>
+    <li><a href="#ref-for-relying-party②④⑧">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-relying-party②④⑨">(2)</a> <a href="#ref-for-relying-party②⑤⓪">(3)</a> <a href="#ref-for-relying-party②⑤①">(4)</a> <a href="#ref-for-relying-party②⑤②">(5)</a> <a href="#ref-for-relying-party②⑤③">(6)</a> <a href="#ref-for-relying-party②⑤④">(7)</a> <a href="#ref-for-relying-party②⑤⑤">(8)</a> <a href="#ref-for-relying-party②⑤⑥">(9)</a> <a href="#ref-for-relying-party②⑤⑦">(10)</a> <a href="#ref-for-relying-party②⑤⑧">(11)</a> <a href="#ref-for-relying-party②⑤⑨">(12)</a> <a href="#ref-for-relying-party②⑥⓪">(13)</a> <a href="#ref-for-relying-party②⑥①">(14)</a> <a href="#ref-for-relying-party②⑥②">(15)</a> <a href="#ref-for-relying-party②⑥③">(16)</a>
+    <li><a href="#ref-for-relying-party②⑥④">9. WebAuthn Extensions</a> <a href="#ref-for-relying-party②⑥⑤">(2)</a> <a href="#ref-for-relying-party②⑥⑥">(3)</a>
+    <li><a href="#ref-for-relying-party②⑥⑦">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-relying-party②⑥⑧">9.3. Extending Request Parameters</a> <a href="#ref-for-relying-party②⑥⑨">(2)</a> <a href="#ref-for-relying-party②⑦⓪">(3)</a>
+    <li><a href="#ref-for-relying-party②⑦①">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-relying-party②⑦②">(2)</a> <a href="#ref-for-relying-party②⑦③">(3)</a> <a href="#ref-for-relying-party②⑦④">(4)</a> <a href="#ref-for-relying-party②⑦⑤">(5)</a>
+    <li><a href="#ref-for-relying-party②⑦⑥">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-relying-party②⑦⑦">(2)</a>
+    <li><a href="#ref-for-relying-party②⑦⑧">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-relying-party②⑦⑨">(2)</a>
+    <li><a href="#ref-for-relying-party②⑧⓪">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-relying-party②⑧①">(2)</a> <a href="#ref-for-relying-party②⑧②">(3)</a> <a href="#ref-for-relying-party②⑧③">(4)</a> <a href="#ref-for-relying-party②⑧④">(5)</a> <a href="#ref-for-relying-party②⑧⑤">(6)</a>
+    <li><a href="#ref-for-relying-party②⑧⑥">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-relying-party②⑧⑦">(2)</a> <a href="#ref-for-relying-party②⑧⑧">(3)</a> <a href="#ref-for-relying-party②⑧⑨">(4)</a> <a href="#ref-for-relying-party②⑨⓪">(5)</a> <a href="#ref-for-relying-party②⑨①">(6)</a> <a href="#ref-for-relying-party②⑨②">(7)</a> <a href="#ref-for-relying-party②⑨③">(8)</a>
+    <li><a href="#ref-for-relying-party②⑨④">10.2.1. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-relying-party②⑨⑤">12.4. WebAuthn Extension Identifier Registrations</a>
+    <li><a href="#ref-for-relying-party②⑨⑥">13. Security Considerations</a> <a href="#ref-for-relying-party②⑨⑦">(2)</a> <a href="#ref-for-relying-party②⑨⑧">(3)</a> <a href="#ref-for-relying-party②⑨⑨">(4)</a>
+    <li><a href="#ref-for-relying-party③⓪⓪">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-relying-party③⓪①">(2)</a>
+    <li><a href="#ref-for-relying-party③⓪②">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a> <a href="#ref-for-relying-party③⓪③">(2)</a>
+    <li><a href="#ref-for-relying-party③⓪④">13.4. Security considerations for Relying Parties</a>
+    <li><a href="#ref-for-relying-party③⓪⑤">13.4.1. Security Benefits for WebAuthn Relying Parties</a> <a href="#ref-for-relying-party③⓪⑥">(2)</a> <a href="#ref-for-relying-party③⓪⑦">(3)</a> <a href="#ref-for-relying-party③⓪⑧">(4)</a> <a href="#ref-for-relying-party③⓪⑨">(5)</a> <a href="#ref-for-relying-party③①⓪">(6)</a>
+    <li><a href="#ref-for-relying-party③①①">13.4.2. Visibility Considerations for Embedded Usage</a> <a href="#ref-for-relying-party③①②">(2)</a> <a href="#ref-for-relying-party③①③">(3)</a> <a href="#ref-for-relying-party③①④">(4)</a>
+    <li><a href="#ref-for-relying-party③①⑤">13.4.3. Cryptographic Challenges</a> <a href="#ref-for-relying-party③①⑥">(2)</a>
+    <li><a href="#ref-for-relying-party③①⑦">13.4.4. Attestation Limitations</a> <a href="#ref-for-relying-party③①⑧">(2)</a> <a href="#ref-for-relying-party③①⑨">(3)</a> <a href="#ref-for-relying-party③②⓪">(4)</a> <a href="#ref-for-relying-party③②①">(5)</a> <a href="#ref-for-relying-party③②②">(6)</a> <a href="#ref-for-relying-party③②③">(7)</a> <a href="#ref-for-relying-party③②④">(8)</a>
+    <li><a href="#ref-for-relying-party③②⑤">13.4.5. Revoked Attestation Certificates</a> <a href="#ref-for-relying-party③②⑥">(2)</a> <a href="#ref-for-relying-party③②⑦">(3)</a>
+    <li><a href="#ref-for-relying-party③②⑧">13.4.6. Credential Loss and Key Mobility</a> <a href="#ref-for-relying-party③②⑨">(2)</a> <a href="#ref-for-relying-party③③⓪">(3)</a>
+    <li><a href="#ref-for-relying-party③③①">13.4.7. Unprotected account detection</a> <a href="#ref-for-relying-party③③②">(2)</a>
+    <li><a href="#ref-for-relying-party③③③">13.4.8. Code injection attacks</a> <a href="#ref-for-relying-party③③④">(2)</a> <a href="#ref-for-relying-party③③⑤">(3)</a> <a href="#ref-for-relying-party③③⑥">(4)</a> <a href="#ref-for-relying-party③③⑦">(5)</a> <a href="#ref-for-relying-party③③⑧">(6)</a> <a href="#ref-for-relying-party③③⑨">(7)</a> <a href="#ref-for-relying-party③④⓪">(8)</a> <a href="#ref-for-relying-party③④①">(9)</a>
+    <li><a href="#ref-for-relying-party③④②">14. Privacy Considerations</a>
+    <li><a href="#ref-for-relying-party③④③">14.1. De-anonymization Prevention Measures</a> <a href="#ref-for-relying-party③④④">(2)</a> <a href="#ref-for-relying-party③④⑤">(3)</a> <a href="#ref-for-relying-party③④⑥">(4)</a> <a href="#ref-for-relying-party③④⑦">(5)</a> <a href="#ref-for-relying-party③④⑧">(6)</a> <a href="#ref-for-relying-party③④⑨">(7)</a>
+    <li><a href="#ref-for-relying-party③⑤⓪">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a> <a href="#ref-for-relying-party③⑤①">(2)</a> <a href="#ref-for-relying-party③⑤②">(3)</a> <a href="#ref-for-relying-party③⑤③">(4)</a> <a href="#ref-for-relying-party③⑤④">(5)</a> <a href="#ref-for-relying-party③⑤⑤">(6)</a> <a href="#ref-for-relying-party③⑤⑥">(7)</a> <a href="#ref-for-relying-party③⑤⑦">(8)</a> <a href="#ref-for-relying-party③⑤⑧">(9)</a> <a href="#ref-for-relying-party③⑤⑨">(10)</a> <a href="#ref-for-relying-party③⑥⓪">(11)</a>
+    <li><a href="#ref-for-relying-party③⑥①">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-relying-party③⑥②">(2)</a> <a href="#ref-for-relying-party③⑥③">(3)</a> <a href="#ref-for-relying-party③⑥④">(4)</a> <a href="#ref-for-relying-party③⑥⑤">(5)</a>
+    <li><a href="#ref-for-relying-party③⑥⑥">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-relying-party③⑥⑦">(2)</a> <a href="#ref-for-relying-party③⑥⑧">(3)</a>
+    <li><a href="#ref-for-relying-party③⑥⑨">14.5.2. Authentication Ceremony Privacy</a> <a href="#ref-for-relying-party③⑦⓪">(2)</a> <a href="#ref-for-relying-party③⑦①">(3)</a>
+    <li><a href="#ref-for-relying-party③⑦②">14.6. Privacy considerations for Relying Parties</a>
+    <li><a href="#ref-for-relying-party③⑦③">14.6.1. User Handle Contents</a> <a href="#ref-for-relying-party③⑦④">(2)</a>
+    <li><a href="#ref-for-relying-party③⑦⑤">14.6.2. Username Enumeration</a> <a href="#ref-for-relying-party③⑦⑥">(2)</a> <a href="#ref-for-relying-party③⑦⑦">(3)</a> <a href="#ref-for-relying-party③⑦⑧">(4)</a> <a href="#ref-for-relying-party③⑦⑨">(5)</a> <a href="#ref-for-relying-party③⑧⓪">(6)</a> <a href="#ref-for-relying-party③⑧①">(7)</a> <a href="#ref-for-relying-party③⑧②">(8)</a> <a href="#ref-for-relying-party③⑧③">(9)</a> <a href="#ref-for-relying-party③⑧④">(10)</a> <a href="#ref-for-relying-party③⑧⑤">(11)</a> <a href="#ref-for-relying-party③⑧⑥">(12)</a>
+    <li><a href="#ref-for-relying-party③⑧⑦">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-relying-party③⑧⑧">(2)</a> <a href="#ref-for-relying-party③⑧⑨">(3)</a> <a href="#ref-for-relying-party③⑨⓪">(4)</a> <a href="#ref-for-relying-party③⑨①">(5)</a>
+    <li><a href="#ref-for-relying-party③⑨②">15. Accessibility Considerations</a> <a href="#ref-for-relying-party③⑨③">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="webauthn-relying-party">
+   <b><a href="#webauthn-relying-party">#webauthn-relying-party</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-webauthn-relying-party①">1. Introduction</a>
+    <li><a href="#ref-for-webauthn-relying-party②">1.1. Specification Roadmap</a>
+    <li><a href="#ref-for-webauthn-relying-party③">1.3.1. Registration</a>
+    <li><a href="#ref-for-webauthn-relying-party④">1.3.2. Registration Specifically with User-Verifying Platform Authenticator</a>
+    <li><a href="#ref-for-webauthn-relying-party⑤">2.3. WebAuthn Relying Parties</a>
+    <li><a href="#ref-for-webauthn-relying-party⑥">4. Terminology</a> <a href="#ref-for-webauthn-relying-party⑦">(2)</a> <a href="#ref-for-webauthn-relying-party⑧">(3)</a>
+    <li><a href="#ref-for-webauthn-relying-party⑨">5. Web Authentication API</a>
+    <li><a href="#ref-for-webauthn-relying-party①⓪">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-webauthn-relying-party①①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-webauthn-relying-party①②">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
+    <li><a href="#ref-for-webauthn-relying-party①③">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-webauthn-relying-party①④">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-webauthn-relying-party①⑤">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-webauthn-relying-party①⑥">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-webauthn-relying-party①⑦">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
+    <li><a href="#ref-for-webauthn-relying-party①⑧">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
+    <li><a href="#ref-for-webauthn-relying-party①⑨">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
+    <li><a href="#ref-for-webauthn-relying-party②⓪">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>
+    <li><a href="#ref-for-webauthn-relying-party②①">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
+    <li><a href="#ref-for-webauthn-relying-party②②">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
+    <li><a href="#ref-for-webauthn-relying-party②③">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
+    <li><a href="#ref-for-webauthn-relying-party②④">6. WebAuthn Authenticator Model</a>
+    <li><a href="#ref-for-webauthn-relying-party②⑤">6.1. Authenticator Data</a>
+    <li><a href="#ref-for-webauthn-relying-party②⑥">6.1.1. Signature Counter Considerations</a>
+    <li><a href="#ref-for-webauthn-relying-party②⑦">6.5. Attestation</a>
+    <li><a href="#ref-for-webauthn-relying-party②⑧">7. WebAuthn Relying Party Operations</a> <a href="#ref-for-webauthn-relying-party②⑨">(2)</a>
+    <li><a href="#ref-for-webauthn-relying-party③⓪">8.4. Android Key Attestation Statement Format</a>
+    <li><a href="#ref-for-webauthn-relying-party③①">8.7. None Attestation Statement Format</a>
+    <li><a href="#ref-for-webauthn-relying-party③②">9. WebAuthn Extensions</a>
+    <li><a href="#ref-for-webauthn-relying-party③③">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-webauthn-relying-party③④">9.3. Extending Request Parameters</a>
+    <li><a href="#ref-for-webauthn-relying-party③⑤">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-webauthn-relying-party③⑥">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-webauthn-relying-party③⑦">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-webauthn-relying-party③⑧">12.2. WebAuthn Attestation Statement Format Identifier Registrations</a>
+    <li><a href="#ref-for-webauthn-relying-party③⑨">12.3. WebAuthn Extension Identifier Registrations Updates</a> <a href="#ref-for-webauthn-relying-party④⓪">(2)</a>
+    <li><a href="#ref-for-webauthn-relying-party④①">12.4. WebAuthn Extension Identifier Registrations</a> <a href="#ref-for-webauthn-relying-party④②">(2)</a>
+    <li><a href="#ref-for-webauthn-relying-party④③">13. Security Considerations</a>
+    <li><a href="#ref-for-webauthn-relying-party④④">13.1. Credential ID Unsigned</a>
+    <li><a href="#ref-for-webauthn-relying-party④⑤">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a>
+    <li><a href="#ref-for-webauthn-relying-party④⑥">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
+    <li><a href="#ref-for-webauthn-relying-party④⑦">13.4.4. Attestation Limitations</a>
+    <li><a href="#ref-for-webauthn-relying-party④⑧">14.1. De-anonymization Prevention Measures</a>
+    <li><a href="#ref-for-webauthn-relying-party④⑨">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
+    <li><a href="#ref-for-webauthn-relying-party⑤⓪">14.3. Authenticator-local Biometric Recognition</a>
+    <li><a href="#ref-for-webauthn-relying-party⑤①">14.5.1. Registration Ceremony Privacy</a>
+    <li><a href="#ref-for-webauthn-relying-party⑤②">14.5.2. Authentication Ceremony Privacy</a>
+    <li><a href="#ref-for-webauthn-relying-party⑤③">14.6.2. Username Enumeration</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="web-application">
+   <b><a href="#web-application">#web-application</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-web-application①">1. Introduction</a>
+    <li><a href="#ref-for-web-application②">1.1. Specification Roadmap</a> <a href="#ref-for-web-application③">(2)</a>
+    <li><a href="#ref-for-web-application④">11. User Agent Automation</a>
+    <li><a href="#ref-for-web-application⑤">12.4. WebAuthn Extension Identifier Registrations</a>
+    <li><a href="#ref-for-web-application⑥">13. Security Considerations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="relying-party-identifier">
@@ -10341,6 +11671,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-relying-party-identifier">4. Terminology</a> <a href="#ref-for-relying-party-identifier①">(2)</a> <a href="#ref-for-relying-party-identifier②">(3)</a>
     <li><a href="#ref-for-relying-party-identifier③">5. Web Authentication API</a>
+    <li><a href="#ref-for-relying-party-identifier④">6.3.5. The silentCredentialDiscovery operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="rp-id">
@@ -10350,19 +11681,22 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-rp-id①②">5. Web Authentication API</a> <a href="#ref-for-rp-id①③">(2)</a> <a href="#ref-for-rp-id①④">(3)</a> <a href="#ref-for-rp-id①⑤">(4)</a> <a href="#ref-for-rp-id①⑥">(5)</a>
     <li><a href="#ref-for-rp-id①⑦">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-rp-id①⑧">(2)</a>
     <li><a href="#ref-for-rp-id①⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-rp-id②⓪">(2)</a>
-    <li><a href="#ref-for-rp-id②①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-rp-id②②">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a>
-    <li><a href="#ref-for-rp-id②③">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>
-    <li><a href="#ref-for-rp-id②④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-rp-id②⑤">(2)</a> <a href="#ref-for-rp-id②⑥">(3)</a>
-    <li><a href="#ref-for-rp-id②⑦">6.1. Authenticator Data</a> <a href="#ref-for-rp-id②⑧">(2)</a> <a href="#ref-for-rp-id②⑨">(3)</a> <a href="#ref-for-rp-id③⓪">(4)</a> <a href="#ref-for-rp-id③①">(5)</a> <a href="#ref-for-rp-id③②">(6)</a>
-    <li><a href="#ref-for-rp-id③③">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-rp-id③④">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-rp-id③⑤">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-rp-id③⑥">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-rp-id③⑦">8.4. Android Key Attestation Statement Format</a>
-    <li><a href="#ref-for-rp-id③⑧">8.6. FIDO U2F Attestation Statement Format</a>
-    <li><a href="#ref-for-rp-id③⑨">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-rp-id④⓪">(2)</a> <a href="#ref-for-rp-id④①">(3)</a> <a href="#ref-for-rp-id④②">(4)</a> <a href="#ref-for-rp-id④③">(5)</a> <a href="#ref-for-rp-id④④">(6)</a> <a href="#ref-for-rp-id④⑤">(7)</a>
-    <li><a href="#ref-for-rp-id④⑥">11.5. Add Credential</a>
+    <li><a href="#ref-for-rp-id②①">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-rp-id②②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-rp-id②③">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a>
+    <li><a href="#ref-for-rp-id②④">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>
+    <li><a href="#ref-for-rp-id②⑤">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-rp-id②⑥">(2)</a> <a href="#ref-for-rp-id②⑦">(3)</a>
+    <li><a href="#ref-for-rp-id②⑧">6.1. Authenticator Data</a> <a href="#ref-for-rp-id②⑨">(2)</a> <a href="#ref-for-rp-id③⓪">(3)</a> <a href="#ref-for-rp-id③①">(4)</a> <a href="#ref-for-rp-id③②">(5)</a> <a href="#ref-for-rp-id③③">(6)</a>
+    <li><a href="#ref-for-rp-id③④">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-rp-id③⑤">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-rp-id③⑥">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-rp-id③⑦">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-rp-id③⑧">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-rp-id③⑨">8.4. Android Key Attestation Statement Format</a>
+    <li><a href="#ref-for-rp-id④⓪">8.6. FIDO U2F Attestation Statement Format</a>
+    <li><a href="#ref-for-rp-id④①">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-rp-id④②">(2)</a> <a href="#ref-for-rp-id④③">(3)</a> <a href="#ref-for-rp-id④④">(4)</a> <a href="#ref-for-rp-id④⑤">(5)</a> <a href="#ref-for-rp-id④⑥">(6)</a> <a href="#ref-for-rp-id④⑦">(7)</a>
+    <li><a href="#ref-for-rp-id④⑧">11.5. Add Credential</a>
+    <li><a href="#ref-for-rp-id④⑨">13.4.8. Code injection attacks</a> <a href="#ref-for-rp-id⑤⓪">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="scope">
@@ -10371,23 +11705,25 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-scope②">1. Introduction</a> <a href="#ref-for-scope③">(2)</a> <a href="#ref-for-scope④">(3)</a>
     <li><a href="#ref-for-scope⑤">4. Terminology</a> <a href="#ref-for-scope⑥">(2)</a>
     <li><a href="#ref-for-scope⑦">5. Web Authentication API</a> <a href="#ref-for-scope⑧">(2)</a>
-    <li><a href="#ref-for-scope⑨">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-scope⑨">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
     <li><a href="#ref-for-scope①⓪">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
     <li><a href="#ref-for-scope①①">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
     <li><a href="#ref-for-scope①②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-scope①③">(2)</a>
     <li><a href="#ref-for-scope①④">6.1. Authenticator Data</a> <a href="#ref-for-scope①⑤">(2)</a>
     <li><a href="#ref-for-scope①⑥">8.4. Android Key Attestation Statement Format</a>
     <li><a href="#ref-for-scope①⑦">8.6. FIDO U2F Attestation Statement Format</a>
-    <li><a href="#ref-for-scope①⑧">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-scope①⑨">(2)</a>
+    <li><a href="#ref-for-scope①⑧">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-scope①⑨">(2)</a>
     <li><a href="#ref-for-scope②⓪">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-scope②①">(2)</a> <a href="#ref-for-scope②②">(3)</a>
     <li><a href="#ref-for-scope②③">13.4.4. Attestation Limitations</a>
-    <li><a href="#ref-for-scope②④">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
+    <li><a href="#ref-for-scope②④">13.4.8. Code injection attacks</a> <a href="#ref-for-scope②⑤">(2)</a> <a href="#ref-for-scope②⑥">(3)</a> <a href="#ref-for-scope②⑦">(4)</a> <a href="#ref-for-scope②⑧">(5)</a>
+    <li><a href="#ref-for-scope②⑨">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">
    <b><a href="#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">#determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised">4. Terminology</a> <a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised①">(2)</a> <a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised②">(3)</a> <a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised③">(4)</a>
+    <li><a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised④">13.4.8. Code injection attacks</a> <a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑤">(2)</a> <a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑥">(3)</a> <a href="#ref-for-determines-the-set-of-origins-on-which-the-public-key-credential-may-be-exercised⑦">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="server-side-public-key-credential-source">
@@ -10402,7 +11738,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-server-side-credential">4. Terminology</a> <a href="#ref-for-server-side-credential①">(2)</a> <a href="#ref-for-server-side-credential②">(3)</a> <a href="#ref-for-server-side-credential③">(4)</a> <a href="#ref-for-server-side-credential④">(5)</a> <a href="#ref-for-server-side-credential⑤">(6)</a>
     <li><a href="#ref-for-server-side-credential⑥">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-server-side-credential⑦">(2)</a> <a href="#ref-for-server-side-credential⑧">(3)</a> <a href="#ref-for-server-side-credential⑨">(4)</a> <a href="#ref-for-server-side-credential①⓪">(5)</a> <a href="#ref-for-server-side-credential①①">(6)</a>
-    <li><a href="#ref-for-server-side-credential①②">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-server-side-credential①③">(2)</a>
+    <li><a href="#ref-for-server-side-credential①②">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-server-side-credential①③">(2)</a>
     <li><a href="#ref-for-server-side-credential①④">11.5. Add Credential</a>
     <li><a href="#ref-for-server-side-credential①⑤">13.4.7. Unprotected account detection</a>
     <li><a href="#ref-for-server-side-credential①⑥">14.6.3. Privacy leak via credential IDs</a>
@@ -10421,25 +11757,27 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-test-of-user-presence⑥">6.1. Authenticator Data</a> <a href="#ref-for-test-of-user-presence⑦">(2)</a>
     <li><a href="#ref-for-test-of-user-presence⑧">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-test-of-user-presence⑨">(2)</a> <a href="#ref-for-test-of-user-presence①⓪">(3)</a>
     <li><a href="#ref-for-test-of-user-presence①①">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-test-of-user-presence①②">(2)</a>
-    <li><a href="#ref-for-test-of-user-presence①③">11.2. Virtual Authenticators</a>
+    <li><a href="#ref-for-test-of-user-presence①③">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-test-of-user-presence①④">11.2. Virtual Authenticators</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="user-account">
    <b><a href="#user-account">#user-account</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-user-account">4. Terminology</a> <a href="#ref-for-user-account①">(2)</a> <a href="#ref-for-user-account②">(3)</a> <a href="#ref-for-user-account③">(4)</a> <a href="#ref-for-user-account④">(5)</a> <a href="#ref-for-user-account⑤">(6)</a> <a href="#ref-for-user-account⑥">(7)</a> <a href="#ref-for-user-account⑦">(8)</a> <a href="#ref-for-user-account⑧">(9)</a> <a href="#ref-for-user-account⑨">(10)</a> <a href="#ref-for-user-account①⓪">(11)</a>
-    <li><a href="#ref-for-user-account①①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-user-account①②">(2)</a> <a href="#ref-for-user-account①③">(3)</a>
-    <li><a href="#ref-for-user-account①④">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-user-account①⑤">(2)</a>
-    <li><a href="#ref-for-user-account①⑥">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-user-account①⑦">(2)</a> <a href="#ref-for-user-account①⑧">(3)</a> <a href="#ref-for-user-account①⑨">(4)</a> <a href="#ref-for-user-account②⓪">(5)</a>
-    <li><a href="#ref-for-user-account②①">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-user-account②②">(2)</a> <a href="#ref-for-user-account②③">(3)</a> <a href="#ref-for-user-account②④">(4)</a> <a href="#ref-for-user-account②⑤">(5)</a>
-    <li><a href="#ref-for-user-account②⑥">6.1.3. Credential Backup State</a> <a href="#ref-for-user-account②⑦">(2)</a>
-    <li><a href="#ref-for-user-account②⑧">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-user-account②⑨">7.1. Registering a New Credential</a> <a href="#ref-for-user-account③⓪">(2)</a>
-    <li><a href="#ref-for-user-account③①">13.4.6. Credential Loss and Key Mobility</a>
-    <li><a href="#ref-for-user-account③②">13.4.7. Unprotected account detection</a> <a href="#ref-for-user-account③③">(2)</a> <a href="#ref-for-user-account③④">(3)</a> <a href="#ref-for-user-account③⑤">(4)</a>
-    <li><a href="#ref-for-user-account③⑥">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
-    <li><a href="#ref-for-user-account③⑦">14.6.1. User Handle Contents</a>
-    <li><a href="#ref-for-user-account③⑧">14.6.2. Username Enumeration</a> <a href="#ref-for-user-account③⑨">(2)</a>
+    <li><a href="#ref-for-user-account">4. Terminology</a> <a href="#ref-for-user-account①">(2)</a> <a href="#ref-for-user-account②">(3)</a> <a href="#ref-for-user-account③">(4)</a> <a href="#ref-for-user-account④">(5)</a> <a href="#ref-for-user-account⑤">(6)</a> <a href="#ref-for-user-account⑥">(7)</a> <a href="#ref-for-user-account⑦">(8)</a> <a href="#ref-for-user-account⑧">(9)</a> <a href="#ref-for-user-account⑨">(10)</a> <a href="#ref-for-user-account①⓪">(11)</a> <a href="#ref-for-user-account①①">(12)</a> <a href="#ref-for-user-account①②">(13)</a>
+    <li><a href="#ref-for-user-account①③">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-user-account①④">(2)</a> <a href="#ref-for-user-account①⑤">(3)</a>
+    <li><a href="#ref-for-user-account①⑥">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-user-account①⑦">(2)</a>
+    <li><a href="#ref-for-user-account①⑧">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-user-account①⑨">(2)</a> <a href="#ref-for-user-account②⓪">(3)</a> <a href="#ref-for-user-account②①">(4)</a> <a href="#ref-for-user-account②②">(5)</a>
+    <li><a href="#ref-for-user-account②③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-user-account②④">(2)</a> <a href="#ref-for-user-account②⑤">(3)</a> <a href="#ref-for-user-account②⑥">(4)</a> <a href="#ref-for-user-account②⑦">(5)</a>
+    <li><a href="#ref-for-user-account②⑧">6.1.3. Credential Backup State</a> <a href="#ref-for-user-account②⑨">(2)</a>
+    <li><a href="#ref-for-user-account③⓪">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-user-account③①">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-user-account③②">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-user-account③③">(2)</a> <a href="#ref-for-user-account③④">(3)</a>
+    <li><a href="#ref-for-user-account③⑤">13.4.6. Credential Loss and Key Mobility</a>
+    <li><a href="#ref-for-user-account③⑥">13.4.7. Unprotected account detection</a> <a href="#ref-for-user-account③⑦">(2)</a> <a href="#ref-for-user-account③⑧">(3)</a> <a href="#ref-for-user-account③⑨">(4)</a>
+    <li><a href="#ref-for-user-account④⓪">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
+    <li><a href="#ref-for-user-account④①">14.6.1. User Handle Contents</a>
+    <li><a href="#ref-for-user-account④②">14.6.2. Username Enumeration</a> <a href="#ref-for-user-account④③">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="user-consent">
@@ -10456,7 +11794,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-user-consent①③">6. WebAuthn Authenticator Model</a> <a href="#ref-for-user-consent①④">(2)</a> <a href="#ref-for-user-consent①⑤">(3)</a>
     <li><a href="#ref-for-user-consent①⑥">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-user-consent①⑦">(2)</a> <a href="#ref-for-user-consent①⑧">(3)</a> <a href="#ref-for-user-consent①⑨">(4)</a>
     <li><a href="#ref-for-user-consent②⓪">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-user-consent②①">(2)</a>
-    <li><a href="#ref-for-user-consent②②">10.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-user-consent②③">(2)</a>
+    <li><a href="#ref-for-user-consent②②">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-user-consent②③">(2)</a>
     <li><a href="#ref-for-user-consent②④">11.2. Virtual Authenticators</a> <a href="#ref-for-user-consent②⑤">(2)</a>
     <li><a href="#ref-for-user-consent②⑥">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
     <li><a href="#ref-for-user-consent②⑦">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-user-consent②⑧">(2)</a>
@@ -10474,10 +11812,20 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-user-handle①⑦">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
     <li><a href="#ref-for-user-handle①⑧">6.2. Authenticator Taxonomy</a>
     <li><a href="#ref-for-user-handle①⑨">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-user-handle②⓪">14.1. De-anonymization Prevention Measures</a>
-    <li><a href="#ref-for-user-handle②①">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
-    <li><a href="#ref-for-user-handle②②">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
-    <li><a href="#ref-for-user-handle②③">14.6.1. User Handle Contents</a> <a href="#ref-for-user-handle②④">(2)</a> <a href="#ref-for-user-handle②⑤">(3)</a>
+    <li><a href="#ref-for-user-handle②⓪">6.3.5. The silentCredentialDiscovery operation</a>
+    <li><a href="#ref-for-user-handle②①">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-user-handle②②">14.1. De-anonymization Prevention Measures</a>
+    <li><a href="#ref-for-user-handle②③">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
+    <li><a href="#ref-for-user-handle②④">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
+    <li><a href="#ref-for-user-handle②⑤">14.6.1. User Handle Contents</a> <a href="#ref-for-user-handle②⑥">(2)</a> <a href="#ref-for-user-handle②⑦">(3)</a> <a href="#ref-for-user-handle②⑧">(4)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="concept-user-present">
+   <b><a href="#concept-user-present">#concept-user-present</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-concept-user-present">4. Terminology</a>
+    <li><a href="#ref-for-concept-user-present①">6.1. Authenticator Data</a> <a href="#ref-for-concept-user-present②">(2)</a> <a href="#ref-for-concept-user-present③">(3)</a>
+    <li><a href="#ref-for-concept-user-present④">13.2. Physical Proximity between Client and Authenticator</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="user-verification">
@@ -10485,7 +11833,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-user-verification">4. Terminology</a> <a href="#ref-for-user-verification①">(2)</a> <a href="#ref-for-user-verification②">(3)</a> <a href="#ref-for-user-verification③">(4)</a> <a href="#ref-for-user-verification④">(5)</a> <a href="#ref-for-user-verification⑤">(6)</a> <a href="#ref-for-user-verification⑥">(7)</a> <a href="#ref-for-user-verification⑦">(8)</a> <a href="#ref-for-user-verification⑧">(9)</a> <a href="#ref-for-user-verification⑨">(10)</a> <a href="#ref-for-user-verification①⓪">(11)</a> <a href="#ref-for-user-verification①①">(12)</a>
     <li><a href="#ref-for-user-verification①②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-user-verification①③">(2)</a> <a href="#ref-for-user-verification①④">(3)</a>
-    <li><a href="#ref-for-user-verification①⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-user-verification①⑥">(2)</a> <a href="#ref-for-user-verification①⑦">(3)</a>
+    <li><a href="#ref-for-user-verification①⑤">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-user-verification①⑥">(2)</a> <a href="#ref-for-user-verification①⑦">(3)</a>
     <li><a href="#ref-for-user-verification①⑧">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
     <li><a href="#ref-for-user-verification①⑨">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
     <li><a href="#ref-for-user-verification②⓪">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-user-verification②①">(2)</a>
@@ -10497,29 +11845,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-user-verification④⓪">6.3.3. The authenticatorGetAssertion Operation</a>
     <li><a href="#ref-for-user-verification④①">7.1. Registering a New Credential</a>
     <li><a href="#ref-for-user-verification④②">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-user-verification④③">11.2. Virtual Authenticators</a> <a href="#ref-for-user-verification④④">(2)</a> <a href="#ref-for-user-verification④⑤">(3)</a>
-    <li><a href="#ref-for-user-verification④⑥">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
-    <li><a href="#ref-for-user-verification④⑦">14.1. De-anonymization Prevention Measures</a>
-    <li><a href="#ref-for-user-verification④⑧">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-user-verification④⑨">(2)</a>
-    <li><a href="#ref-for-user-verification⑤⓪">14.4.2. Privacy of personally identifying information Stored in Authenticators</a> <a href="#ref-for-user-verification⑤①">(2)</a> <a href="#ref-for-user-verification⑤②">(3)</a>
-    <li><a href="#ref-for-user-verification⑤③">15. Accessibility Considerations</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="concept-user-present">
-   <b><a href="#concept-user-present">#concept-user-present</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-concept-user-present">4. Terminology</a>
-    <li><a href="#ref-for-concept-user-present①">6.1. Authenticator Data</a> <a href="#ref-for-concept-user-present②">(2)</a> <a href="#ref-for-concept-user-present③">(3)</a>
-    <li><a href="#ref-for-concept-user-present④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-concept-user-present⑤">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-concept-user-present⑥">13.2. Physical Proximity between Client and Authenticator</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="up">
-   <b><a href="#up">#up</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-up">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-up①">6.1.2. FIDO U2F Signature Format Compatibility</a>
+    <li><a href="#ref-for-user-verification④③">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-user-verification④④">(2)</a> <a href="#ref-for-user-verification④⑤">(3)</a>
+    <li><a href="#ref-for-user-verification④⑥">11.2. Virtual Authenticators</a> <a href="#ref-for-user-verification④⑦">(2)</a> <a href="#ref-for-user-verification④⑧">(3)</a>
+    <li><a href="#ref-for-user-verification④⑨">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
+    <li><a href="#ref-for-user-verification⑤⓪">14.1. De-anonymization Prevention Measures</a>
+    <li><a href="#ref-for-user-verification⑤①">14.3. Authenticator-local Biometric Recognition</a> <a href="#ref-for-user-verification⑤②">(2)</a>
+    <li><a href="#ref-for-user-verification⑤③">14.4.2. Privacy of personally identifying information Stored in Authenticators</a> <a href="#ref-for-user-verification⑤④">(2)</a> <a href="#ref-for-user-verification⑤⑤">(3)</a>
+    <li><a href="#ref-for-user-verification⑤⑥">14.6.1. User Handle Contents</a>
+    <li><a href="#ref-for-user-verification⑤⑦">15. Accessibility Considerations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="concept-user-verified">
@@ -10527,77 +11860,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-concept-user-verified">4. Terminology</a>
     <li><a href="#ref-for-concept-user-verified①">6.1. Authenticator Data</a> <a href="#ref-for-concept-user-verified②">(2)</a> <a href="#ref-for-concept-user-verified③">(3)</a>
-    <li><a href="#ref-for-concept-user-verified④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-concept-user-verified⑤">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-concept-user-verified⑥">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="uv">
-   <b><a href="#uv">#uv</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-uv">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-uv①">(2)</a>
-    <li><a href="#ref-for-uv②">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-uv③">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-uv④">(2)</a> <a href="#ref-for-uv⑤">(3)</a>
-    <li><a href="#ref-for-uv⑥">14.3. Authenticator-local Biometric Recognition</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="webauthn-relying-party">
-   <b><a href="#webauthn-relying-party">#webauthn-relying-party</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-webauthn-relying-party①">1. Introduction</a>
-    <li><a href="#ref-for-webauthn-relying-party②">1.1. Specification Roadmap</a>
-    <li><a href="#ref-for-webauthn-relying-party③">1.3.1. Registration</a>
-    <li><a href="#ref-for-webauthn-relying-party④">1.3.2. Registration Specifically with User-Verifying Platform Authenticator</a>
-    <li><a href="#ref-for-webauthn-relying-party⑤">2.3. WebAuthn Relying Parties</a>
-    <li><a href="#ref-for-webauthn-relying-party⑥">4. Terminology</a> <a href="#ref-for-webauthn-relying-party⑦">(2)</a> <a href="#ref-for-webauthn-relying-party⑧">(3)</a> <a href="#ref-for-webauthn-relying-party⑨">(4)</a>
-    <li><a href="#ref-for-webauthn-relying-party①⓪">5. Web Authentication API</a>
-    <li><a href="#ref-for-webauthn-relying-party①①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-webauthn-relying-party①②">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
-    <li><a href="#ref-for-webauthn-relying-party①③">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-webauthn-relying-party①④">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-webauthn-relying-party①⑤">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
-    <li><a href="#ref-for-webauthn-relying-party①⑥">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
-    <li><a href="#ref-for-webauthn-relying-party①⑦">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
-    <li><a href="#ref-for-webauthn-relying-party①⑧">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>
-    <li><a href="#ref-for-webauthn-relying-party①⑨">5.8.1. Client Data Used in WebAuthn Signatures (dictionary CollectedClientData)</a>
-    <li><a href="#ref-for-webauthn-relying-party②⓪">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
-    <li><a href="#ref-for-webauthn-relying-party②①">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
-    <li><a href="#ref-for-webauthn-relying-party②②">6. WebAuthn Authenticator Model</a>
-    <li><a href="#ref-for-webauthn-relying-party②③">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-webauthn-relying-party②④">6.1.1. Signature Counter Considerations</a>
-    <li><a href="#ref-for-webauthn-relying-party②⑤">6.5. Attestation</a>
-    <li><a href="#ref-for-webauthn-relying-party②⑥">7. WebAuthn Relying Party Operations</a> <a href="#ref-for-webauthn-relying-party②⑦">(2)</a>
-    <li><a href="#ref-for-webauthn-relying-party②⑧">8.4. Android Key Attestation Statement Format</a>
-    <li><a href="#ref-for-webauthn-relying-party②⑨">8.7. None Attestation Statement Format</a>
-    <li><a href="#ref-for-webauthn-relying-party③⓪">9. WebAuthn Extensions</a>
-    <li><a href="#ref-for-webauthn-relying-party③①">9.2. Defining Extensions</a>
-    <li><a href="#ref-for-webauthn-relying-party③②">9.3. Extending Request Parameters</a>
-    <li><a href="#ref-for-webauthn-relying-party③③">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-webauthn-relying-party③④">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-webauthn-relying-party③⑤">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-webauthn-relying-party③⑥">12.3. WebAuthn Extension Identifier Registrations Updates</a> <a href="#ref-for-webauthn-relying-party③⑦">(2)</a>
-    <li><a href="#ref-for-webauthn-relying-party③⑧">12.4. WebAuthn Extension Identifier Registrations</a> <a href="#ref-for-webauthn-relying-party③⑨">(2)</a>
-    <li><a href="#ref-for-webauthn-relying-party④⓪">13. Security Considerations</a>
-    <li><a href="#ref-for-webauthn-relying-party④①">13.1. Credential ID Unsigned</a>
-    <li><a href="#ref-for-webauthn-relying-party④②">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a>
-    <li><a href="#ref-for-webauthn-relying-party④③">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
-    <li><a href="#ref-for-webauthn-relying-party④④">13.4.4. Attestation Limitations</a>
-    <li><a href="#ref-for-webauthn-relying-party④⑤">14.1. De-anonymization Prevention Measures</a>
-    <li><a href="#ref-for-webauthn-relying-party④⑥">14.2. Anonymous, Scoped, Non-correlatable Public Key Credentials</a>
-    <li><a href="#ref-for-webauthn-relying-party④⑦">14.3. Authenticator-local Biometric Recognition</a>
-    <li><a href="#ref-for-webauthn-relying-party④⑧">14.5.1. Registration Ceremony Privacy</a>
-    <li><a href="#ref-for-webauthn-relying-party④⑨">14.5.2. Authentication Ceremony Privacy</a>
-    <li><a href="#ref-for-webauthn-relying-party⑤⓪">14.6.2. Username Enumeration</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="web-application">
-   <b><a href="#web-application">#web-application</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-web-application①">1. Introduction</a>
-    <li><a href="#ref-for-web-application②">1.1. Specification Roadmap</a> <a href="#ref-for-web-application③">(2)</a>
-    <li><a href="#ref-for-web-application④">11. User Agent Automation</a>
-    <li><a href="#ref-for-web-application⑤">12.4. WebAuthn Extension Identifier Registrations</a>
-    <li><a href="#ref-for-web-application⑥">13. Security Considerations</a>
+    <li><a href="#ref-for-concept-user-verified④">14.4.2. Privacy of personally identifying information Stored in Authenticators</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="web-authentication-api">
@@ -10616,16 +11879,18 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#publickeycredential">#publickeycredential</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-publickeycredential">1. Introduction</a>
-    <li><a href="#ref-for-publickeycredential①">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-publickeycredential②">(2)</a> <a href="#ref-for-publickeycredential③">(3)</a> <a href="#ref-for-publickeycredential④">(4)</a> <a href="#ref-for-publickeycredential⑤">(5)</a> <a href="#ref-for-publickeycredential⑥">(6)</a> <a href="#ref-for-publickeycredential⑦">(7)</a> <a href="#ref-for-publickeycredential⑧">(8)</a>
-    <li><a href="#ref-for-publickeycredential⑨">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-publickeycredential①⓪">(2)</a>
-    <li><a href="#ref-for-publickeycredential①①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-publickeycredential①②">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a> <a href="#ref-for-publickeycredential①③">(2)</a>
-    <li><a href="#ref-for-publickeycredential①④">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
-    <li><a href="#ref-for-publickeycredential①⑤">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
-    <li><a href="#ref-for-publickeycredential①⑥">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-publickeycredential①⑦">(2)</a> <a href="#ref-for-publickeycredential①⑧">(3)</a> <a href="#ref-for-publickeycredential①⑨">(4)</a>
-    <li><a href="#ref-for-publickeycredential②⓪">7. WebAuthn Relying Party Operations</a>
-    <li><a href="#ref-for-publickeycredential②①">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-publickeycredential②②">13.4.4. Attestation Limitations</a>
+    <li><a href="#ref-for-publickeycredential①">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-publickeycredential②">(2)</a> <a href="#ref-for-publickeycredential③">(3)</a> <a href="#ref-for-publickeycredential④">(4)</a> <a href="#ref-for-publickeycredential⑤">(5)</a> <a href="#ref-for-publickeycredential⑥">(6)</a> <a href="#ref-for-publickeycredential⑦">(7)</a> <a href="#ref-for-publickeycredential⑧">(8)</a> <a href="#ref-for-publickeycredential⑨">(9)</a> <a href="#ref-for-publickeycredential①⓪">(10)</a>
+    <li><a href="#ref-for-publickeycredential①①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-publickeycredential①②">(2)</a>
+    <li><a href="#ref-for-publickeycredential①③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-publickeycredential①④">5.1.5. Store an Existing Credential - PublicKeyCredential’s [[Store]](credential, sameOriginWithAncestors) Method</a> <a href="#ref-for-publickeycredential①⑤">(2)</a>
+    <li><a href="#ref-for-publickeycredential①⑥">5.1.7. Availability of User-Verifying Platform Authenticator - PublicKeyCredential’s isUserVerifyingPlatformAuthenticatorAvailable() Method</a>
+    <li><a href="#ref-for-publickeycredential①⑦">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-publickeycredential①⑧">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-publickeycredential①⑨">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
+    <li><a href="#ref-for-publickeycredential②⓪">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-publickeycredential②①">(2)</a> <a href="#ref-for-publickeycredential②②">(3)</a> <a href="#ref-for-publickeycredential②③">(4)</a>
+    <li><a href="#ref-for-publickeycredential②④">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-publickeycredential②⑤">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-publickeycredential②⑥">13.4.4. Attestation Limitations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-rawid">
@@ -10633,17 +11898,31 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-dom-publickeycredential-rawid">5.1. PublicKeyCredential Interface</a>
     <li><a href="#ref-for-dom-publickeycredential-rawid①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
-    <li><a href="#ref-for-dom-publickeycredential-rawid②">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-dom-publickeycredential-rawid③">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-publickeycredential-rawid②">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dom-publickeycredential-rawid③">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-publickeycredential-rawid④">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredential-rawid⑤">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-getclientextensionresults">
    <b><a href="#dom-publickeycredential-getclientextensionresults">#dom-publickeycredential-getclientextensionresults</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults">5.1. PublicKeyCredential Interface</a>
-    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults①">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults②">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults③">9.4. Client Extension Processing</a>
+    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dom-publickeycredential-getclientextensionresults①">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults②">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults③">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dom-publickeycredential-getclientextensionresults④">9.4. Client Extension Processing</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-publickeycredential-isconditionalmediationavailable">
+   <b><a href="#dom-publickeycredential-isconditionalmediationavailable">#dom-publickeycredential-isconditionalmediationavailable</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-publickeycredential-isconditionalmediationavailable">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-dom-publickeycredential-isconditionalmediationavailable①">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-publickeycredential-tojson">
+   <b><a href="#dom-publickeycredential-tojson">#dom-publickeycredential-tojson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-publickeycredential-tojson">5.1. PublicKeyCredential Interface</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-response">
@@ -10654,8 +11933,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredential-response②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-dom-publickeycredential-response③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-dom-publickeycredential-response④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
-    <li><a href="#ref-for-dom-publickeycredential-response⑤">7.1. Registering a New Credential</a> <a href="#ref-for-dom-publickeycredential-response⑥">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredential-response⑦">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-publickeycredential-response⑧">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredential-response⑤">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dom-publickeycredential-response⑥">7.2. Verifying an Authentication Assertion</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-authenticatorattachment">
@@ -10667,6 +11946,68 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredential-authenticatorattachment④">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="typedefdef-base64urlstring">
+   <b><a href="#typedefdef-base64urlstring">#typedefdef-base64urlstring</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-typedefdef-base64urlstring">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-typedefdef-base64urlstring①">(2)</a> <a href="#ref-for-typedefdef-base64urlstring②">(3)</a> <a href="#ref-for-typedefdef-base64urlstring③">(4)</a> <a href="#ref-for-typedefdef-base64urlstring④">(5)</a> <a href="#ref-for-typedefdef-base64urlstring⑤">(6)</a> <a href="#ref-for-typedefdef-base64urlstring⑥">(7)</a> <a href="#ref-for-typedefdef-base64urlstring⑦">(8)</a> <a href="#ref-for-typedefdef-base64urlstring⑧">(9)</a> <a href="#ref-for-typedefdef-base64urlstring⑨">(10)</a>
+    <li><a href="#ref-for-typedefdef-base64urlstring①⓪">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-typedefdef-base64urlstring①①">(2)</a> <a href="#ref-for-typedefdef-base64urlstring①②">(3)</a>
+    <li><a href="#ref-for-typedefdef-base64urlstring①③">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="typedefdef-publickeycredentialjson">
+   <b><a href="#typedefdef-publickeycredentialjson">#typedefdef-publickeycredentialjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-typedefdef-publickeycredentialjson">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-registrationresponsejson">
+   <b><a href="#dictdef-registrationresponsejson">#dictdef-registrationresponsejson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-registrationresponsejson">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dictdef-registrationresponsejson①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-registrationresponsejson-clientextensionresults">
+   <b><a href="#dom-registrationresponsejson-clientextensionresults">#dom-registrationresponsejson-clientextensionresults</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-registrationresponsejson-clientextensionresults">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticatorattestationresponsejson">
+   <b><a href="#dictdef-authenticatorattestationresponsejson">#dictdef-authenticatorattestationresponsejson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticatorattestationresponsejson">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticatorattestationresponsejson-transports">
+   <b><a href="#dom-authenticatorattestationresponsejson-transports">#dom-authenticatorattestationresponsejson-transports</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticatorattestationresponsejson-transports">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticationresponsejson">
+   <b><a href="#dictdef-authenticationresponsejson">#dictdef-authenticationresponsejson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticationresponsejson">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dictdef-authenticationresponsejson①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationresponsejson-clientextensionresults">
+   <b><a href="#dom-authenticationresponsejson-clientextensionresults">#dom-authenticationresponsejson-clientextensionresults</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationresponsejson-clientextensionresults">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticatorassertionresponsejson">
+   <b><a href="#dictdef-authenticatorassertionresponsejson">#dictdef-authenticatorassertionresponsejson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticatorassertionresponsejson">5.1. PublicKeyCredential Interface</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticationextensionsclientoutputsjson">
+   <b><a href="#dictdef-authenticationextensionsclientoutputsjson">#dictdef-authenticationextensionsclientoutputsjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputsjson">5.1. PublicKeyCredential Interface</a> <a href="#ref-for-dictdef-authenticationextensionsclientoutputsjson①">(2)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-identifier-slot">
    <b><a href="#dom-publickeycredential-identifier-slot">#dom-publickeycredential-identifier-slot</a></b><b>Referenced in:</b>
    <ul>
@@ -10695,8 +12036,8 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#dom-credentialrequestoptions-publickey">#dom-credentialrequestoptions-publickey</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-credentialrequestoptions-publickey">4. Terminology</a>
-    <li><a href="#ref-for-dom-credentialrequestoptions-publickey①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialrequestoptions-publickey②">(2)</a> <a href="#ref-for-dom-credentialrequestoptions-publickey③">(3)</a>
-    <li><a href="#ref-for-dom-credentialrequestoptions-publickey④">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-publickey①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-credentialrequestoptions-publickey②">(2)</a> <a href="#ref-for-dom-credentialrequestoptions-publickey③">(3)</a> <a href="#ref-for-dom-credentialrequestoptions-publickey④">(4)</a> <a href="#ref-for-dom-credentialrequestoptions-publickey⑤">(5)</a>
+    <li><a href="#ref-for-dom-credentialrequestoptions-publickey⑥">7.2. Verifying an Authentication Assertion</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-create-slot">
@@ -10707,7 +12048,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredential-create-slot②">5.2.1.1. Easily accessing credential data</a>
     <li><a href="#ref-for-dom-publickeycredential-create-slot③">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
     <li><a href="#ref-for-dom-publickeycredential-create-slot④">5.6. Abort Operations with AbortSignal</a> <a href="#ref-for-dom-publickeycredential-create-slot⑤">(2)</a> <a href="#ref-for-dom-publickeycredential-create-slot⑥">(3)</a> <a href="#ref-for-dom-publickeycredential-create-slot⑦">(4)</a> <a href="#ref-for-dom-publickeycredential-create-slot⑧">(5)</a>
-    <li><a href="#ref-for-dom-publickeycredential-create-slot⑨">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-publickeycredential-create-slot①⓪">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredential-create-slot⑨">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-publickeycredential-create-slot①⓪">(2)</a>
     <li><a href="#ref-for-dom-publickeycredential-create-slot①①">14.5.1. Registration Ceremony Privacy</a>
    </ul>
   </aside>
@@ -10726,7 +12067,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="create-candidate-authenticator">
    <b><a href="#create-candidate-authenticator">#create-candidate-authenticator</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-create-candidate-authenticator">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-create-candidate-authenticator①">(2)</a> <a href="#ref-for-create-candidate-authenticator②">(3)</a>
+    <li><a href="#ref-for-create-candidate-authenticator">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-create-candidate-authenticator①">(2)</a> <a href="#ref-for-create-candidate-authenticator②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="effective-resident-key-requirement-for-credential-creation">
@@ -10744,7 +12085,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="create-selected-authenticator">
    <b><a href="#create-selected-authenticator">#create-selected-authenticator</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-create-selected-authenticator">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-create-selected-authenticator①">(2)</a>
+    <li><a href="#ref-for-create-selected-authenticator">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-create-selected-authenticator①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="credentialcreationdata-attestationobjectresult">
@@ -10769,7 +12110,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#credentialcreationdata-clientextensionresults">#credentialcreationdata-clientextensionresults</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-credentialcreationdata-clientextensionresults">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-credentialcreationdata-clientextensionresults①">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-credentialcreationdata-clientextensionresults①">10.1.3. Credential Properties Extension (credProps)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-collectfromcredentialstore-slot">
@@ -10784,12 +12125,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot">4. Terminology</a>
     <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①">5.1. PublicKeyCredential Interface</a>
     <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot②">5.1.4. Use an Existing Credential to Make an Assertion - PublicKeyCredential’s [[Get]](options) Method</a>
-    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
-    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">5.6. Abort Operations with AbortSignal</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">(2)</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">(3)</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">(4)</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑧">(5)</a>
-    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑨">5.9. Permissions Policy integration</a>
-    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⓪">5.10. Using Web Authentication within iframe elements</a>
-    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">10.5. Large blob storage extension (largeBlob)</a>
-    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">14.5.2. Authentication Ceremony Privacy</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot③">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot④">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑤">5.4.5. Authenticator Attachment Enumeration (enum AuthenticatorAttachment)</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑥">5.6. Abort Operations with AbortSignal</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑦">(2)</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑧">(3)</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot⑨">(4)</a> <a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①⓪">(5)</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①①">5.9. Permissions Policy integration</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①②">5.10. Using Web Authentication within iframe elements</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①③">10.1.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-slot①④">14.5.2. Authentication Ceremony Privacy</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-origin">
@@ -10804,12 +12146,6 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredential-discoverfromexternalsource-origin-options-sameoriginwithancestors-sameoriginwithancestors">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="effective-user-verification-requirement-for-assertion">
-   <b><a href="#effective-user-verification-requirement-for-assertion">#effective-user-verification-requirement-for-assertion</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-effective-user-verification-requirement-for-assertion">6.3.3. The authenticatorGetAssertion Operation</a>
-   </ul>
-  </aside>
   <aside class="dfn-panel" data-for="assertioncreationdata-credentialidresult">
    <b><a href="#assertioncreationdata-credentialidresult">#assertioncreationdata-credentialidresult</a></b><b>Referenced in:</b>
    <ul>
@@ -10847,12 +12183,69 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-assertioncreationdata-clientextensionresults">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="publickeycredential-issuing-a-credential-request-to-an-authenticator">
+   <b><a href="#publickeycredential-issuing-a-credential-request-to-an-authenticator">#publickeycredential-issuing-a-credential-request-to-an-authenticator</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator①">(2)</a>
+    <li><a href="#ref-for-publickeycredential-issuing-a-credential-request-to-an-authenticator②">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="effective-user-verification-requirement-for-assertion">
+   <b><a href="#effective-user-verification-requirement-for-assertion">#effective-user-verification-requirement-for-assertion</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-effective-user-verification-requirement-for-assertion">6.3.3. The authenticatorGetAssertion Operation</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">
    <b><a href="#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">#dom-publickeycredential-isuserverifyingplatformauthenticatoravailable</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-publickeycredential-isuserverifyingplatformauthenticatoravailable">5.1. PublicKeyCredential Interface</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="dom-publickeycredential-parsecreationoptionsfromjson-options-options">
+   <b><a href="#dom-publickeycredential-parsecreationoptionsfromjson-options-options">#dom-publickeycredential-parsecreationoptionsfromjson-options-options</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-publickeycredential-parsecreationoptionsfromjson-options-options">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-publickeycredentialcreationoptionsjson">
+   <b><a href="#dictdef-publickeycredentialcreationoptionsjson">#dictdef-publickeycredentialcreationoptionsjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptionsjson">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-dictdef-publickeycredentialcreationoptionsjson①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-publickeycredentialuserentityjson">
+   <b><a href="#dictdef-publickeycredentialuserentityjson">#dictdef-publickeycredentialuserentityjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-publickeycredentialuserentityjson">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-publickeycredentialdescriptorjson">
+   <b><a href="#dictdef-publickeycredentialdescriptorjson">#dictdef-publickeycredentialdescriptorjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptorjson">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptorjson①">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticationextensionsclientinputsjson">
+   <b><a href="#dictdef-authenticationextensionsclientinputsjson">#dictdef-authenticationextensionsclientinputsjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputsjson">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-dictdef-authenticationextensionsclientinputsjson①">(2)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputsjson②">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a> <a href="#ref-for-dictdef-authenticationextensionsclientinputsjson③">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-publickeycredential-parserequestoptionsfromjson-options-options">
+   <b><a href="#dom-publickeycredential-parserequestoptionsfromjson-options-options">#dom-publickeycredential-parserequestoptionsfromjson-options-options</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-publickeycredential-parserequestoptionsfromjson-options-options">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-publickeycredentialrequestoptionsjson">
+   <b><a href="#dictdef-publickeycredentialrequestoptionsjson">#dictdef-publickeycredentialrequestoptionsjson</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptionsjson">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptionsjson①">(2)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="authenticatorresponse">
    <b><a href="#authenticatorresponse">#authenticatorresponse</a></b><b>Referenced in:</b>
    <ul>
@@ -10865,14 +12258,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="dom-authenticatorresponse-clientdatajson">
    <b><a href="#dom-authenticatorresponse-clientdatajson">#dom-authenticatorresponse-clientdatajson</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson②">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson④">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson⑤">5.8.1.2. Limited Verification Algorithm</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson⑥">7.1. Registering a New Credential</a> <a href="#ref-for-dom-authenticatorresponse-clientdatajson⑦">(2)</a>
-    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson⑧">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson">4. Terminology</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson③">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson④">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson⑤">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson⑥">5.8.1.2. Limited Verification Algorithm</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson⑦">7.1. Registering a New Credential</a> <a href="#ref-for-dom-authenticatorresponse-clientdatajson⑧">(2)</a> <a href="#ref-for-dom-authenticatorresponse-clientdatajson⑨">(3)</a>
+    <li><a href="#ref-for-dom-authenticatorresponse-clientdatajson①⓪">7.2. Verifying an Authentication Assertion</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticatorattestationresponse">
@@ -10889,11 +12283,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="dom-authenticatorattestationresponse-gettransports">
    <b><a href="#dom-authenticatorattestationresponse-gettransports">#dom-authenticatorattestationresponse-gettransports</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-authenticatorattestationresponse-gettransports②">(2)</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports③">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports⑤">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-authenticatorattestationresponse-gettransports⑥">(2)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports">4. Terminology</a> <a href="#ref-for-dom-authenticatorattestationresponse-gettransports①">(2)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports②">5.1. PublicKeyCredential Interface</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-authenticatorattestationresponse-gettransports⑤">(2)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports⑥">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-gettransports⑦">7.1. Registering a New Credential</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticatorattestationresponse-getauthenticatordata">
@@ -10920,10 +12315,11 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="dom-authenticatorattestationresponse-attestationobject">
    <b><a href="#dom-authenticatorattestationresponse-attestationobject">#dom-authenticatorattestationresponse-attestationobject</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject①">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject②">(2)</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject③">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject④">(2)</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject⑤">(3)</a>
-    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject⑥">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject">4. Terminology</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject②">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject③">(2)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject④">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject⑤">(2)</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject⑥">(3)</a>
+    <li><a href="#ref-for-dom-authenticatorattestationresponse-attestationobject⑦">7.1. Registering a New Credential</a> <a href="#ref-for-dom-authenticatorattestationresponse-attestationobject⑧">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticatorattestationresponse-transports-slot">
@@ -10971,14 +12367,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-authenticatorassertionresponse-userhandle③">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
     <li><a href="#ref-for-dom-authenticatorassertionresponse-userhandle④">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
     <li><a href="#ref-for-dom-authenticatorassertionresponse-userhandle⑤">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-dom-authenticatorassertionresponse-userhandle⑥">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-authenticatorassertionresponse-userhandle⑦">(2)</a>
+    <li><a href="#ref-for-dom-authenticatorassertionresponse-userhandle⑥">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-authenticatorassertionresponse-userhandle⑦">(2)</a> <a href="#ref-for-dom-authenticatorassertionresponse-userhandle⑧">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-publickeycredentialparameters">
    <b><a href="#dictdef-publickeycredentialparameters">#dictdef-publickeycredentialparameters</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-publickeycredentialparameters">5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)</a> <a href="#ref-for-dictdef-publickeycredentialparameters①">(2)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialparameters②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-publickeycredentialparameters③">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialparameters">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialparameters①">5.3. Parameters for Credential Generation (dictionary PublicKeyCredentialParameters)</a> <a href="#ref-for-dictdef-publickeycredentialparameters②">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialparameters③">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-publickeycredentialparameters④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialparameters-type">
@@ -11001,11 +12398,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions">5.1.1. CredentialCreationOptions Dictionary Extension</a>
     <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions③">5.8.1.2. Limited Verification Algorithm</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions④">7. WebAuthn Relying Party Operations</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions⑤">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions⑥">13.4.3. Cryptographic Challenges</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions②">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a> <a href="#ref-for-dictdef-publickeycredentialcreationoptions③">(2)</a> <a href="#ref-for-dictdef-publickeycredentialcreationoptions④">(3)</a> <a href="#ref-for-dictdef-publickeycredentialcreationoptions⑤">(4)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions⑥">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions⑦">5.8.1.2. Limited Verification Algorithm</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions⑧">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions⑨">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialcreationoptions①⓪">13.4.3. Cryptographic Challenges</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialcreationoptions-rp">
@@ -11057,7 +12455,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">10.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">(2)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">(3)</a>
+    <li><a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">(2)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials">(3)</a>
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials②">13.4.6. Credential Loss and Key Mobility</a>
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials③">14.5.1. Registration Ceremony Privacy</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-excludecredentials④">(2)</a>
    </ul>
@@ -11068,7 +12466,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①">(2)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection②">(3)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection③">(4)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection④">(5)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑤">(6)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑥">(7)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑦">(8)</a> <a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑧">(9)</a>
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection⑨">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
     <li><a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①⓪">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
-    <li><a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①①">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-publickeycredentialcreationoptions-authenticatorselection①①">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialcreationoptions-attestation">
@@ -11098,20 +12496,22 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="dom-publickeycredentialentity-name">
    <b><a href="#dom-publickeycredentialentity-name">#dom-publickeycredentialentity-name</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-publickeycredentialentity-name">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dom-publickeycredentialentity-name①">(2)</a> <a href="#ref-for-dom-publickeycredentialentity-name②">(3)</a>
-    <li><a href="#ref-for-dom-publickeycredentialentity-name③">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-dom-publickeycredentialentity-name④">(2)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑤">(3)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑥">(4)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑦">(5)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑧">(6)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑨">(7)</a>
-    <li><a href="#ref-for-dom-publickeycredentialentity-name①⓪">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>
-    <li><a href="#ref-for-dom-publickeycredentialentity-name①①">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-dom-publickeycredentialentity-name①②">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialentity-name①③">6.4. String Handling</a>
+    <li><a href="#ref-for-dom-publickeycredentialentity-name">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-publickeycredentialentity-name①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dom-publickeycredentialentity-name②">(2)</a> <a href="#ref-for-dom-publickeycredentialentity-name③">(3)</a>
+    <li><a href="#ref-for-dom-publickeycredentialentity-name④">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑤">(2)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑥">(3)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑦">(4)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑧">(5)</a> <a href="#ref-for-dom-publickeycredentialentity-name⑨">(6)</a> <a href="#ref-for-dom-publickeycredentialentity-name①⓪">(7)</a>
+    <li><a href="#ref-for-dom-publickeycredentialentity-name①①">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a>
+    <li><a href="#ref-for-dom-publickeycredentialentity-name①②">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-dom-publickeycredentialentity-name①③">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialentity-name①④">6.4. String Handling</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-publickeycredentialrpentity">
    <b><a href="#dictdef-publickeycredentialrpentity">#dictdef-publickeycredentialrpentity</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-publickeycredentialrpentity">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-publickeycredentialrpentity①">(2)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrpentity②">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrpentity③">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> <a href="#ref-for-dictdef-publickeycredentialrpentity④">(2)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrpentity⑤">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrpentity">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrpentity①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-publickeycredentialrpentity②">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrpentity③">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrpentity④">5.4.2. Relying Party Parameters for Credential Generation (dictionary PublicKeyCredentialRpEntity)</a> <a href="#ref-for-dictdef-publickeycredentialrpentity⑤">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrpentity⑥">6.3.2. The authenticatorMakeCredential Operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialrpentity-id">
@@ -11151,18 +12551,20 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#dom-publickeycredentialuserentity-displayname">#dom-publickeycredentialuserentity-displayname</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname">4. Terminology</a>
-    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname②">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname③">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
-    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname④">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑤">(2)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑥">(3)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑦">(4)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑧">(5)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑨">(6)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname①⓪">(7)</a>
-    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname①①">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname①②">6.4. String Handling</a>
+    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname③">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname④">5.4.1. Public Key Entity Description (dictionary PublicKeyCredentialEntity)</a>
+    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname⑤">5.4.3. User Account Parameters for Credential Generation (dictionary PublicKeyCredentialUserEntity)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑥">(2)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑦">(3)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑧">(4)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname⑨">(5)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname①⓪">(6)</a> <a href="#ref-for-dom-publickeycredentialuserentity-displayname①①">(7)</a>
+    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname①②">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-dom-publickeycredentialuserentity-displayname①③">6.4. String Handling</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-authenticatorselectioncriteria">
    <b><a href="#dictdef-authenticatorselectioncriteria">#dictdef-authenticatorselectioncriteria</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-authenticatorselectioncriteria">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-authenticatorselectioncriteria①">(2)</a>
-    <li><a href="#ref-for-dictdef-authenticatorselectioncriteria②">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-dictdef-authenticatorselectioncriteria③">(2)</a>
+    <li><a href="#ref-for-dictdef-authenticatorselectioncriteria">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-dictdef-authenticatorselectioncriteria①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-authenticatorselectioncriteria②">(2)</a>
+    <li><a href="#ref-for-dictdef-authenticatorselectioncriteria③">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-dictdef-authenticatorselectioncriteria④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticatorselectioncriteria-authenticatorattachment">
@@ -11179,7 +12581,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-authenticatorselectioncriteria-residentkey②">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-dom-authenticatorselectioncriteria-residentkey③">(2)</a> <a href="#ref-for-dom-authenticatorselectioncriteria-residentkey④">(3)</a>
     <li><a href="#ref-for-dom-authenticatorselectioncriteria-residentkey⑤">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
     <li><a href="#ref-for-dom-authenticatorselectioncriteria-residentkey⑥">6.2.2. Credential Storage Modality</a>
-    <li><a href="#ref-for-dom-authenticatorselectioncriteria-residentkey⑦">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-authenticatorselectioncriteria-residentkey⑦">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticatorselectioncriteria-requireresidentkey">
@@ -11241,7 +12643,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-dom-residentkeyrequirement-preferred">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-residentkeyrequirement-preferred①">(2)</a>
     <li><a href="#ref-for-dom-residentkeyrequirement-preferred②">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a> <a href="#ref-for-dom-residentkeyrequirement-preferred③">(2)</a>
-    <li><a href="#ref-for-dom-residentkeyrequirement-preferred④">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-residentkeyrequirement-preferred④">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-residentkeyrequirement-required">
@@ -11250,7 +12652,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-residentkeyrequirement-required">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-residentkeyrequirement-required①">(2)</a>
     <li><a href="#ref-for-dom-residentkeyrequirement-required②">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-dom-residentkeyrequirement-required③">(2)</a>
     <li><a href="#ref-for-dom-residentkeyrequirement-required④">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
-    <li><a href="#ref-for-dom-residentkeyrequirement-required⑤">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-residentkeyrequirement-required⑤">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="attestation-conveyance">
@@ -11307,12 +12709,14 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions">5.1.2. CredentialRequestOptions Dictionary Extension</a>
     <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptions③">(2)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions④">5.8.1.2. Limited Verification Algorithm</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions⑤">7. WebAuthn Relying Party Operations</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions⑥">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions⑦">13.4.3. Cryptographic Challenges</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions⑧">14.6.2. Username Enumeration</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions②">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptions③">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions④">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptions⑤">(2)</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptions⑥">(3)</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptions⑦">(4)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions⑧">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dictdef-publickeycredentialrequestoptions⑨">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions①⓪">5.8.1.2. Limited Verification Algorithm</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions①①">7. WebAuthn Relying Party Operations</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions①②">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions①③">13.4.3. Cryptographic Challenges</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialrequestoptions①④">14.6.2. Username Enumeration</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialrequestoptions-challenge">
@@ -11337,31 +12741,34 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-dom-publickeycredentialrequestoptions-rpid">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-rpid①">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-rpid②">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-rpid③">(4)</a>
     <li><a href="#ref-for-dom-publickeycredentialrequestoptions-rpid④">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-rpid⑤">10.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-rpid⑤">10.1.1. FIDO AppID Extension (appid)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialrequestoptions-allowcredentials">
    <b><a href="#dom-publickeycredentialrequestoptions-allowcredentials">#dom-publickeycredentialrequestoptions-allowcredentials</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials">4. Terminology</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③">(4)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials④">(5)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑥">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑦">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">(4)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">(5)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⓪">(6)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①①">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①②">6.2.2. Credential Storage Modality</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①④">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">(3)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">10.5. Large blob storage extension (largeBlob)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">13.4.7. Unprotected account detection</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">(3)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">14.5.2. Authentication Ceremony Privacy</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">14.6.2. Username Enumeration</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">(4)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">(5)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑥">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑦">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑧">(4)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials⑨">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⓪">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①①">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①②">(4)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①④">6.2.2. Credential Storage Modality</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑤">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑥">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑦">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑧">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials①⑨">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⓪">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②①">10.1.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②②">13.4.7. Unprotected account detection</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②③">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②④">(3)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑤">14.5.2. Authentication Ceremony Privacy</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑥">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑦">14.6.2. Username Enumeration</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑧">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials②⑨">14.6.3. Privacy leak via credential IDs</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③⓪">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③①">(3)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③②">(4)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-allowcredentials③③">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialrequestoptions-userverification">
    <b><a href="#dom-publickeycredentialrequestoptions-userverification">#dom-publickeycredentialrequestoptions-userverification</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-userverification">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-userverification①">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-userverification②">(3)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-userverification">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-userverification①">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-userverification②">(2)</a>
     <li><a href="#ref-for-dom-publickeycredentialrequestoptions-userverification③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-userverification④">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialrequestoptions-userverification⑤">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-userverification⑥">(2)</a> <a href="#ref-for-dom-publickeycredentialrequestoptions-userverification⑦">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialrequestoptions-extensions">
@@ -11379,11 +12786,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dictdef-authenticationextensionsclientinputs③">(2)</a>
     <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs④">5.7. WebAuthn Extensions Inputs and Outputs</a>
     <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑤">5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑥">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑦">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑧">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑨">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs①⓪">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑥">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑦">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑧">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs⑨">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs①⓪">10.1.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientinputs①①">10.2.1. User Verification Method Extension (uvm)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-authenticationextensionsclientoutputs">
@@ -11394,11 +12802,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs③">5.7. WebAuthn Extensions Inputs and Outputs</a>
     <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs④">5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑤">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑥">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑦">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑧">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑨">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dictdef-authenticationextensionsclientoutputs①⓪">(2)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑤">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑥">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑦">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑧">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs⑨">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dictdef-authenticationextensionsclientoutputs①⓪">(2)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionsclientoutputs①①">10.2.1. User Verification Method Extension (uvm)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-collectedclientdata">
@@ -11468,6 +12877,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-collectedclientdata-origin⑥">5.8.1.3. Future development</a>
     <li><a href="#ref-for-dom-collectedclientdata-origin⑦">7.1. Registering a New Credential</a>
     <li><a href="#ref-for-dom-collectedclientdata-origin⑧">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dom-collectedclientdata-origin⑨">13.4.8. Code injection attacks</a> <a href="#ref-for-dom-collectedclientdata-origin①⓪">(2)</a> <a href="#ref-for-dom-collectedclientdata-origin①①">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-collectedclientdata-crossorigin">
@@ -11519,21 +12929,22 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data②">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data③">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data④">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑤">6. WebAuthn Authenticator Model</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">6.1.2. FIDO U2F Signature Format Compatibility</a> <a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑦">(2)</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">(2)</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①①">6.5.2. Attestation Statement Formats</a> <a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①②">(2)</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①③">6.5.4. Generating an Attestation Object</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">8.2. Packed Attestation Statement Format</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑤">8.3. TPM Attestation Statement Format</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑥">8.4. Android Key Attestation Statement Format</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑦">8.5. Android SafetyNet Attestation Statement Format</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑧">8.6. FIDO U2F Attestation Statement Format</a>
-    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑨">8.8. Apple Anonymous Attestation Statement Format</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data②">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data③">5.2. Authenticator Responses (interface AuthenticatorResponse)</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data④">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑤">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑥">6. WebAuthn Authenticator Model</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑦">6.1.2. FIDO U2F Signature Format Compatibility</a> <a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑧">(2)</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data⑨">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⓪">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①①">(2)</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①②">6.5.2. Attestation Statement Formats</a> <a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①③">(2)</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①④">6.5.4. Generating an Attestation Object</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑤">8.2. Packed Attestation Statement Format</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑥">8.3. TPM Attestation Statement Format</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑦">8.4. Android Key Attestation Statement Format</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑧">8.5. Android SafetyNet Attestation Statement Format</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data①⑨">8.6. FIDO U2F Attestation Statement Format</a>
+    <li><a href="#ref-for-collectedclientdata-hash-of-the-serialized-client-data②⓪">8.8. Apple Anonymous Attestation Statement Format</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="ccdtostring">
@@ -11552,6 +12963,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-enumdef-publickeycredentialtype⑤">5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)</a> <a href="#ref-for-enumdef-publickeycredentialtype⑥">(2)</a>
     <li><a href="#ref-for-enumdef-publickeycredentialtype⑦">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
     <li><a href="#ref-for-enumdef-publickeycredentialtype⑧">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-enumdef-publickeycredentialtype⑨">(2)</a> <a href="#ref-for-enumdef-publickeycredentialtype①⓪">(3)</a>
+    <li><a href="#ref-for-enumdef-publickeycredentialtype①①">6.3.5. The silentCredentialDiscovery operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialtype-public-key">
@@ -11561,52 +12973,56 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-publickeycredentialtype-public-key①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialtype-public-key②">(2)</a>
     <li><a href="#ref-for-dom-publickeycredentialtype-public-key③">5.8.2. Credential Type Enumeration (enum PublicKeyCredentialType)</a>
     <li><a href="#ref-for-dom-publickeycredentialtype-public-key④">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-dom-publickeycredentialtype-public-key⑤">10.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-dom-publickeycredentialtype-public-key⑤">10.1.1. FIDO AppID Extension (appid)</a>
     <li><a href="#ref-for-dom-publickeycredentialtype-public-key⑥">11.5. Add Credential</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-publickeycredentialdescriptor">
    <b><a href="#dictdef-publickeycredentialdescriptor">#dictdef-publickeycredentialdescriptor</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor①">(2)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor②">(3)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor③">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor④">(2)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor⑤">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor⑥">(2)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor⑦">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor⑧">(2)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor⑨">(3)</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor①⓪">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor①①">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor">4. Terminology</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor②">(2)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor③">(3)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor④">(4)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor⑤">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor⑥">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor⑦">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor⑧">(2)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor⑨">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor①⓪">(2)</a> <a href="#ref-for-dictdef-publickeycredentialdescriptor①①">(3)</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor①②">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor①③">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-dictdef-publickeycredentialdescriptor">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialdescriptor-type">
    <b><a href="#dom-publickeycredentialdescriptor-type">#dom-publickeycredentialdescriptor-type</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-type②">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type③">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type④">10.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type">4. Terminology</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type①">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type②">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-type③">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type④">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-type⑤">10.1.1. FIDO AppID Extension (appid)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialdescriptor-id">
    <b><a href="#dom-publickeycredentialdescriptor-id">#dom-publickeycredentialdescriptor-id</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id①">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id②">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id③">(2)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id④">(3)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id⑤">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id⑥">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id⑦">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id⑧">10.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id⑨">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id">4. Terminology</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id②">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id③">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id④">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id⑤">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id⑥">(2)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id⑦">(3)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id⑧">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id⑨">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id①⓪">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-id①①">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-id①②">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-publickeycredentialdescriptor-transports">
    <b><a href="#dom-publickeycredentialdescriptor-transports">#dom-publickeycredentialdescriptor-transports</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports">2.1.1. Enumerations as DOMString types</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports②">(2)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports③">(3)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports④">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports⑤">(2)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports⑥">(3)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports⑦">(4)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports⑧">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports⑨">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports①⓪">(2)</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports①①">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports①②">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports①">4. Terminology</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports③">(2)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports④">(3)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports⑥">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports⑦">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports⑧">(2)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports⑨">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-dom-publickeycredentialdescriptor-transports①⓪">5.8.3. Credential Descriptor (dictionary PublicKeyCredentialDescriptor)</a> <a href="#ref-for-dom-publickeycredentialdescriptor-transports①①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="enumdef-authenticatortransport">
@@ -11638,6 +13054,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-dom-authenticatortransport-ble">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="dom-authenticatortransport-hybrid">
+   <b><a href="#dom-authenticatortransport-hybrid">#dom-authenticatortransport-hybrid</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticatortransport-hybrid">5.8.4. Authenticator Transport Enumeration (enum AuthenticatorTransport)</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="dom-authenticatortransport-internal">
    <b><a href="#dom-authenticatortransport-internal">#dom-authenticatortransport-internal</a></b><b>Referenced in:</b>
    <ul>
@@ -11666,31 +13088,38 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-enumdef-userverificationrequirement">5.4.4. Authenticator Selection Criteria (dictionary AuthenticatorSelectionCriteria)</a> <a href="#ref-for-enumdef-userverificationrequirement①">(2)</a>
     <li><a href="#ref-for-enumdef-userverificationrequirement②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a> <a href="#ref-for-enumdef-userverificationrequirement③">(2)</a>
     <li><a href="#ref-for-enumdef-userverificationrequirement④">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-enumdef-userverificationrequirement⑤">(2)</a>
+    <li><a href="#ref-for-enumdef-userverificationrequirement⑥">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-userverificationrequirement-required">
    <b><a href="#dom-userverificationrequirement-required">#dom-userverificationrequirement-required</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-userverificationrequirement-required">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-userverificationrequirement-required①">(2)</a> <a href="#ref-for-dom-userverificationrequirement-required②">(3)</a>
-    <li><a href="#ref-for-dom-userverificationrequirement-required③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-userverificationrequirement-required④">(2)</a> <a href="#ref-for-dom-userverificationrequirement-required⑤">(3)</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-required③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-required④">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-dom-userverificationrequirement-required⑤">(2)</a>
     <li><a href="#ref-for-dom-userverificationrequirement-required⑥">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
     <li><a href="#ref-for-dom-userverificationrequirement-required⑦">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-required⑧">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-userverificationrequirement-preferred">
    <b><a href="#dom-userverificationrequirement-preferred">#dom-userverificationrequirement-preferred</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-userverificationrequirement-preferred">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-userverificationrequirement-preferred①">(2)</a>
-    <li><a href="#ref-for-dom-userverificationrequirement-preferred②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-userverificationrequirement-preferred③">(2)</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-preferred②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-preferred③">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
     <li><a href="#ref-for-dom-userverificationrequirement-preferred④">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-preferred⑤">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-userverificationrequirement-preferred⑥">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-userverificationrequirement-discouraged">
    <b><a href="#dom-userverificationrequirement-discouraged">#dom-userverificationrequirement-discouraged</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-userverificationrequirement-discouraged">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-userverificationrequirement-discouraged①">(2)</a>
-    <li><a href="#ref-for-dom-userverificationrequirement-discouraged②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-dom-userverificationrequirement-discouraged③">(2)</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-discouraged②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-discouraged③">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
     <li><a href="#ref-for-dom-userverificationrequirement-discouraged④">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a>
+    <li><a href="#ref-for-dom-userverificationrequirement-discouraged⑤">10.1.4. Pseudo-random function extension (prf)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="publickey-credentials-get-feature">
@@ -11715,20 +13144,21 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authenticator-credentials-map①">6.3.1. Lookup Credential Source by Credential ID Algorithm</a>
     <li><a href="#ref-for-authenticator-credentials-map②">6.3.2. The authenticatorMakeCredential Operation</a>
     <li><a href="#ref-for-authenticator-credentials-map③">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-authenticator-credentials-map④">6.3.5. The silentCredentialDiscovery operation</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="attestation-signature">
    <b><a href="#attestation-signature">#attestation-signature</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-attestation-signature">4. Terminology</a>
-    <li><a href="#ref-for-attestation-signature①">6. WebAuthn Authenticator Model</a> <a href="#ref-for-attestation-signature②">(2)</a> <a href="#ref-for-attestation-signature③">(3)</a> <a href="#ref-for-attestation-signature④">(4)</a>
-    <li><a href="#ref-for-attestation-signature⑤">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-attestation-signature⑥">6.5. Attestation</a>
-    <li><a href="#ref-for-attestation-signature⑦">6.5.3. Attestation Types</a>
-    <li><a href="#ref-for-attestation-signature⑧">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-attestation-signature⑨">8.2. Packed Attestation Statement Format</a> <a href="#ref-for-attestation-signature①⓪">(2)</a>
-    <li><a href="#ref-for-attestation-signature①①">8.3. TPM Attestation Statement Format</a> <a href="#ref-for-attestation-signature①②">(2)</a>
-    <li><a href="#ref-for-attestation-signature①③">8.6. FIDO U2F Attestation Statement Format</a>
+    <li><a href="#ref-for-attestation-signature">4. Terminology</a> <a href="#ref-for-attestation-signature①">(2)</a>
+    <li><a href="#ref-for-attestation-signature②">6. WebAuthn Authenticator Model</a> <a href="#ref-for-attestation-signature③">(2)</a> <a href="#ref-for-attestation-signature④">(3)</a> <a href="#ref-for-attestation-signature⑤">(4)</a>
+    <li><a href="#ref-for-attestation-signature⑥">6.1. Authenticator Data</a>
+    <li><a href="#ref-for-attestation-signature⑦">6.5. Attestation</a>
+    <li><a href="#ref-for-attestation-signature⑧">6.5.3. Attestation Types</a>
+    <li><a href="#ref-for-attestation-signature⑨">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-attestation-signature①⓪">8.2. Packed Attestation Statement Format</a> <a href="#ref-for-attestation-signature①①">(2)</a>
+    <li><a href="#ref-for-attestation-signature①②">8.3. TPM Attestation Statement Format</a> <a href="#ref-for-attestation-signature①③">(2)</a>
+    <li><a href="#ref-for-attestation-signature①④">8.6. FIDO U2F Attestation Statement Format</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="assertion-signature">
@@ -11753,88 +13183,141 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <b><a href="#authenticator-data">#authenticator-data</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-authenticator-data">1.1. Specification Roadmap</a>
-    <li><a href="#ref-for-authenticator-data①">4. Terminology</a> <a href="#ref-for-authenticator-data②">(2)</a>
-    <li><a href="#ref-for-authenticator-data③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-authenticator-data④">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-authenticator-data⑤">(2)</a> <a href="#ref-for-authenticator-data⑥">(3)</a>
-    <li><a href="#ref-for-authenticator-data⑦">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-authenticator-data⑧">(2)</a> <a href="#ref-for-authenticator-data⑨">(3)</a> <a href="#ref-for-authenticator-data①⓪">(4)</a> <a href="#ref-for-authenticator-data①①">(5)</a>
-    <li><a href="#ref-for-authenticator-data①②">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
-    <li><a href="#ref-for-authenticator-data①③">5.7. WebAuthn Extensions Inputs and Outputs</a>
-    <li><a href="#ref-for-authenticator-data①④">6. WebAuthn Authenticator Model</a> <a href="#ref-for-authenticator-data①⑤">(2)</a>
-    <li><a href="#ref-for-authenticator-data①⑥">6.1. Authenticator Data</a> <a href="#ref-for-authenticator-data①⑦">(2)</a> <a href="#ref-for-authenticator-data①⑧">(3)</a> <a href="#ref-for-authenticator-data①⑨">(4)</a> <a href="#ref-for-authenticator-data②⓪">(5)</a> <a href="#ref-for-authenticator-data②①">(6)</a> <a href="#ref-for-authenticator-data②②">(7)</a> <a href="#ref-for-authenticator-data②③">(8)</a> <a href="#ref-for-authenticator-data②④">(9)</a> <a href="#ref-for-authenticator-data②⑤">(10)</a> <a href="#ref-for-authenticator-data②⑥">(11)</a>
-    <li><a href="#ref-for-authenticator-data②⑦">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-authenticator-data②⑧">(2)</a> <a href="#ref-for-authenticator-data②⑨">(3)</a> <a href="#ref-for-authenticator-data③⓪">(4)</a>
-    <li><a href="#ref-for-authenticator-data③①">6.1.2. FIDO U2F Signature Format Compatibility</a> <a href="#ref-for-authenticator-data③②">(2)</a> <a href="#ref-for-authenticator-data③③">(3)</a>
-    <li><a href="#ref-for-authenticator-data③④">6.1.3. Credential Backup State</a>
-    <li><a href="#ref-for-authenticator-data③⑤">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-authenticator-data③⑥">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-authenticator-data③⑦">6.5. Attestation</a> <a href="#ref-for-authenticator-data③⑧">(2)</a>
-    <li><a href="#ref-for-authenticator-data③⑨">6.5.1. Attested Credential Data</a>
-    <li><a href="#ref-for-authenticator-data④⓪">6.5.2. Attestation Statement Formats</a> <a href="#ref-for-authenticator-data④①">(2)</a>
-    <li><a href="#ref-for-authenticator-data④②">6.5.4. Generating an Attestation Object</a>
-    <li><a href="#ref-for-authenticator-data④③">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-authenticator-data④④">8.5. Android SafetyNet Attestation Statement Format</a>
-    <li><a href="#ref-for-authenticator-data④⑤">9.5. Authenticator Extension Processing</a> <a href="#ref-for-authenticator-data④⑥">(2)</a>
-    <li><a href="#ref-for-authenticator-data④⑦">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-authenticator-data④⑧">13.1. Credential ID Unsigned</a>
-    <li><a href="#ref-for-authenticator-data④⑨">13.3.1. Attestation Certificate Hierarchy</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="rpidhash">
-   <b><a href="#rpidhash">#rpidhash</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-rpidhash">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-rpidhash①">6.1.2. FIDO U2F Signature Format Compatibility</a>
-    <li><a href="#ref-for-rpidhash②">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-rpidhash③">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-rpidhash④">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-rpidhash⑤">(2)</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="flags">
-   <b><a href="#flags">#flags</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-flags">4. Terminology</a> <a href="#ref-for-flags①">(2)</a>
-    <li><a href="#ref-for-flags②">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-flags③">(2)</a>
-    <li><a href="#ref-for-flags④">6.1. Authenticator Data</a> <a href="#ref-for-flags⑤">(2)</a> <a href="#ref-for-flags⑥">(3)</a> <a href="#ref-for-flags⑦">(4)</a> <a href="#ref-for-flags⑧">(5)</a> <a href="#ref-for-flags⑨">(6)</a> <a href="#ref-for-flags①⓪">(7)</a> <a href="#ref-for-flags①①">(8)</a> <a href="#ref-for-flags①②">(9)</a> <a href="#ref-for-flags①③">(10)</a> <a href="#ref-for-flags①④">(11)</a>
-    <li><a href="#ref-for-flags①⑤">6.1.2. FIDO U2F Signature Format Compatibility</a>
-    <li><a href="#ref-for-flags①⑥">6.1.3. Credential Backup State</a> <a href="#ref-for-flags①⑦">(2)</a> <a href="#ref-for-flags①⑧">(3)</a> <a href="#ref-for-flags①⑨">(4)</a> <a href="#ref-for-flags②⓪">(5)</a> <a href="#ref-for-flags②①">(6)</a> <a href="#ref-for-flags②②">(7)</a> <a href="#ref-for-flags②③">(8)</a> <a href="#ref-for-flags②④">(9)</a>
-    <li><a href="#ref-for-flags②⑤">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-flags②⑥">(2)</a>
-    <li><a href="#ref-for-flags②⑦">7.1. Registering a New Credential</a> <a href="#ref-for-flags②⑧">(2)</a> <a href="#ref-for-flags②⑨">(3)</a> <a href="#ref-for-flags③⓪">(4)</a>
-    <li><a href="#ref-for-flags③①">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-flags③②">(2)</a> <a href="#ref-for-flags③③">(3)</a>
-    <li><a href="#ref-for-flags③④">14.3. Authenticator-local Biometric Recognition</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="signcount">
-   <b><a href="#signcount">#signcount</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-signcount">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-signcount①">(2)</a> <a href="#ref-for-signcount②">(3)</a> <a href="#ref-for-signcount③">(4)</a>
-    <li><a href="#ref-for-signcount④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-signcount⑤">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-signcount⑥">(2)</a> <a href="#ref-for-signcount⑦">(3)</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="attestedcredentialdata">
-   <b><a href="#attestedcredentialdata">#attestedcredentialdata</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-attestedcredentialdata">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-attestedcredentialdata①">5.2.1.1. Easily accessing credential data</a>
-    <li><a href="#ref-for-attestedcredentialdata②">6.1. Authenticator Data</a> <a href="#ref-for-attestedcredentialdata③">(2)</a>
-    <li><a href="#ref-for-attestedcredentialdata④">6.1.2. FIDO U2F Signature Format Compatibility</a>
-    <li><a href="#ref-for-attestedcredentialdata⑤">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-attestedcredentialdata⑥">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-attestedcredentialdata⑦">7.1. Registering a New Credential</a> <a href="#ref-for-attestedcredentialdata⑧">(2)</a>
-    <li><a href="#ref-for-attestedcredentialdata⑨">8.3. TPM Attestation Statement Format</a>
-    <li><a href="#ref-for-attestedcredentialdata①⓪">8.4. Android Key Attestation Statement Format</a>
-    <li><a href="#ref-for-attestedcredentialdata①①">8.6. FIDO U2F Attestation Statement Format</a> <a href="#ref-for-attestedcredentialdata①②">(2)</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="authdataextensions">
-   <b><a href="#authdataextensions">#authdataextensions</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-authdataextensions">6.1. Authenticator Data</a> <a href="#ref-for-authdataextensions①">(2)</a> <a href="#ref-for-authdataextensions②">(3)</a> <a href="#ref-for-authdataextensions③">(4)</a>
-    <li><a href="#ref-for-authdataextensions④">6.1.2. FIDO U2F Signature Format Compatibility</a>
-    <li><a href="#ref-for-authdataextensions⑤">6.3.2. The authenticatorMakeCredential Operation</a>
-    <li><a href="#ref-for-authdataextensions⑥">6.3.3. The authenticatorGetAssertion Operation</a>
-    <li><a href="#ref-for-authdataextensions⑦">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-authdataextensions⑧">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-authdataextensions⑨">9.5. Authenticator Extension Processing</a> <a href="#ref-for-authdataextensions①⓪">(2)</a>
+    <li><a href="#ref-for-authenticator-data①">4. Terminology</a> <a href="#ref-for-authenticator-data②">(2)</a> <a href="#ref-for-authenticator-data③">(3)</a> <a href="#ref-for-authenticator-data④">(4)</a>
+    <li><a href="#ref-for-authenticator-data⑤">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-authenticator-data⑥">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-authenticator-data⑦">(2)</a> <a href="#ref-for-authenticator-data⑧">(3)</a>
+    <li><a href="#ref-for-authenticator-data⑨">5.2.1.1. Easily accessing credential data</a> <a href="#ref-for-authenticator-data①⓪">(2)</a> <a href="#ref-for-authenticator-data①①">(3)</a> <a href="#ref-for-authenticator-data①②">(4)</a> <a href="#ref-for-authenticator-data①③">(5)</a>
+    <li><a href="#ref-for-authenticator-data①④">5.2.2. Web Authentication Assertion (interface AuthenticatorAssertionResponse)</a>
+    <li><a href="#ref-for-authenticator-data①⑤">5.7. WebAuthn Extensions Inputs and Outputs</a>
+    <li><a href="#ref-for-authenticator-data①⑥">6. WebAuthn Authenticator Model</a> <a href="#ref-for-authenticator-data①⑦">(2)</a>
+    <li><a href="#ref-for-authenticator-data①⑧">6.1. Authenticator Data</a> <a href="#ref-for-authenticator-data①⑨">(2)</a> <a href="#ref-for-authenticator-data②⓪">(3)</a> <a href="#ref-for-authenticator-data②①">(4)</a> <a href="#ref-for-authenticator-data②②">(5)</a> <a href="#ref-for-authenticator-data②③">(6)</a> <a href="#ref-for-authenticator-data②④">(7)</a> <a href="#ref-for-authenticator-data②⑤">(8)</a> <a href="#ref-for-authenticator-data②⑥">(9)</a> <a href="#ref-for-authenticator-data②⑦">(10)</a> <a href="#ref-for-authenticator-data②⑧">(11)</a>
+    <li><a href="#ref-for-authenticator-data②⑨">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-authenticator-data③⓪">(2)</a> <a href="#ref-for-authenticator-data③①">(3)</a> <a href="#ref-for-authenticator-data③②">(4)</a>
+    <li><a href="#ref-for-authenticator-data③③">6.1.2. FIDO U2F Signature Format Compatibility</a> <a href="#ref-for-authenticator-data③④">(2)</a> <a href="#ref-for-authenticator-data③⑤">(3)</a>
+    <li><a href="#ref-for-authenticator-data③⑥">6.1.3. Credential Backup State</a>
+    <li><a href="#ref-for-authenticator-data③⑦">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-authenticator-data③⑧">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-authenticator-data③⑨">6.5. Attestation</a> <a href="#ref-for-authenticator-data④⓪">(2)</a>
+    <li><a href="#ref-for-authenticator-data④①">6.5.1. Attested Credential Data</a>
+    <li><a href="#ref-for-authenticator-data④②">6.5.2. Attestation Statement Formats</a> <a href="#ref-for-authenticator-data④③">(2)</a>
+    <li><a href="#ref-for-authenticator-data④④">6.5.4. Generating an Attestation Object</a>
+    <li><a href="#ref-for-authenticator-data④⑤">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authenticator-data④⑥">8.5. Android SafetyNet Attestation Statement Format</a>
+    <li><a href="#ref-for-authenticator-data④⑦">9.5. Authenticator Extension Processing</a> <a href="#ref-for-authenticator-data④⑧">(2)</a>
+    <li><a href="#ref-for-authenticator-data④⑨">10.2.1. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-authenticator-data⑤⓪">13.1. Credential ID Unsigned</a>
+    <li><a href="#ref-for-authenticator-data⑤①">13.3.1. Attestation Certificate Hierarchy</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-rpidhash">
+   <b><a href="#authdata-rpidhash">#authdata-rpidhash</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-rpidhash">6.1. Authenticator Data</a>
+    <li><a href="#ref-for-authdata-rpidhash①">6.1.2. FIDO U2F Signature Format Compatibility</a>
+    <li><a href="#ref-for-authdata-rpidhash②">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-rpidhash③">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-authdata-rpidhash④">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-authdata-rpidhash⑤">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags">
+   <b><a href="#authdata-flags">#authdata-flags</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags">4. Terminology</a> <a href="#ref-for-authdata-flags①">(2)</a> <a href="#ref-for-authdata-flags②">(3)</a> <a href="#ref-for-authdata-flags③">(4)</a>
+    <li><a href="#ref-for-authdata-flags④">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-authdata-flags⑤">(2)</a>
+    <li><a href="#ref-for-authdata-flags⑥">6.1. Authenticator Data</a> <a href="#ref-for-authdata-flags⑦">(2)</a> <a href="#ref-for-authdata-flags⑧">(3)</a> <a href="#ref-for-authdata-flags⑨">(4)</a> <a href="#ref-for-authdata-flags①⓪">(5)</a> <a href="#ref-for-authdata-flags①①">(6)</a> <a href="#ref-for-authdata-flags①②">(7)</a> <a href="#ref-for-authdata-flags①③">(8)</a> <a href="#ref-for-authdata-flags①④">(9)</a> <a href="#ref-for-authdata-flags①⑤">(10)</a> <a href="#ref-for-authdata-flags①⑥">(11)</a>
+    <li><a href="#ref-for-authdata-flags①⑦">6.1.2. FIDO U2F Signature Format Compatibility</a>
+    <li><a href="#ref-for-authdata-flags①⑧">6.1.3. Credential Backup State</a> <a href="#ref-for-authdata-flags①⑨">(2)</a> <a href="#ref-for-authdata-flags②⓪">(3)</a> <a href="#ref-for-authdata-flags②①">(4)</a> <a href="#ref-for-authdata-flags②②">(5)</a> <a href="#ref-for-authdata-flags②③">(6)</a> <a href="#ref-for-authdata-flags②④">(7)</a> <a href="#ref-for-authdata-flags②⑤">(8)</a> <a href="#ref-for-authdata-flags②⑥">(9)</a>
+    <li><a href="#ref-for-authdata-flags②⑦">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-authdata-flags②⑧">(2)</a> <a href="#ref-for-authdata-flags②⑨">(3)</a>
+    <li><a href="#ref-for-authdata-flags③⓪">7.1. Registering a New Credential</a> <a href="#ref-for-authdata-flags③①">(2)</a> <a href="#ref-for-authdata-flags③②">(3)</a> <a href="#ref-for-authdata-flags③③">(4)</a> <a href="#ref-for-authdata-flags③④">(5)</a> <a href="#ref-for-authdata-flags③⑤">(6)</a>
+    <li><a href="#ref-for-authdata-flags③⑥">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-authdata-flags③⑦">(2)</a> <a href="#ref-for-authdata-flags③⑧">(3)</a> <a href="#ref-for-authdata-flags③⑨">(4)</a>
+    <li><a href="#ref-for-authdata-flags④⓪">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-authdata-flags④①">14.3. Authenticator-local Biometric Recognition</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags-up">
+   <b><a href="#authdata-flags-up">#authdata-flags-up</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags-up">6.1. Authenticator Data</a> <a href="#ref-for-authdata-flags-up①">(2)</a>
+    <li><a href="#ref-for-authdata-flags-up②">6.1.2. FIDO U2F Signature Format Compatibility</a>
+    <li><a href="#ref-for-authdata-flags-up③">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-flags-up④">7.2. Verifying an Authentication Assertion</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags-uv">
+   <b><a href="#authdata-flags-uv">#authdata-flags-uv</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags-uv">5.8.6. User Verification Requirement Enumeration (enum UserVerificationRequirement)</a> <a href="#ref-for-authdata-flags-uv①">(2)</a>
+    <li><a href="#ref-for-authdata-flags-uv②">6.1. Authenticator Data</a> <a href="#ref-for-authdata-flags-uv③">(2)</a>
+    <li><a href="#ref-for-authdata-flags-uv④">6.2.3. Authentication Factor Capability</a> <a href="#ref-for-authdata-flags-uv⑤">(2)</a> <a href="#ref-for-authdata-flags-uv⑥">(3)</a>
+    <li><a href="#ref-for-authdata-flags-uv⑦">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-flags-uv⑧">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-authdata-flags-uv⑨">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-authdata-flags-uv①⓪">14.3. Authenticator-local Biometric Recognition</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags-be">
+   <b><a href="#authdata-flags-be">#authdata-flags-be</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags-be">4. Terminology</a>
+    <li><a href="#ref-for-authdata-flags-be①">6.1.3. Credential Backup State</a> <a href="#ref-for-authdata-flags-be②">(2)</a> <a href="#ref-for-authdata-flags-be③">(3)</a> <a href="#ref-for-authdata-flags-be④">(4)</a> <a href="#ref-for-authdata-flags-be⑤">(5)</a>
+    <li><a href="#ref-for-authdata-flags-be⑥">7.1. Registering a New Credential</a> <a href="#ref-for-authdata-flags-be⑦">(2)</a>
+    <li><a href="#ref-for-authdata-flags-be⑧">7.2. Verifying an Authentication Assertion</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags-bs">
+   <b><a href="#authdata-flags-bs">#authdata-flags-bs</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags-bs">4. Terminology</a>
+    <li><a href="#ref-for-authdata-flags-bs①">6.1.3. Credential Backup State</a> <a href="#ref-for-authdata-flags-bs②">(2)</a> <a href="#ref-for-authdata-flags-bs③">(3)</a> <a href="#ref-for-authdata-flags-bs④">(4)</a> <a href="#ref-for-authdata-flags-bs⑤">(5)</a> <a href="#ref-for-authdata-flags-bs⑥">(6)</a>
+    <li><a href="#ref-for-authdata-flags-bs⑦">7.1. Registering a New Credential</a> <a href="#ref-for-authdata-flags-bs⑧">(2)</a>
+    <li><a href="#ref-for-authdata-flags-bs⑨">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-authdata-flags-bs①⓪">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags-at">
+   <b><a href="#authdata-flags-at">#authdata-flags-at</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags-at">6.1. Authenticator Data</a> <a href="#ref-for-authdata-flags-at①">(2)</a> <a href="#ref-for-authdata-flags-at②">(3)</a> <a href="#ref-for-authdata-flags-at③">(4)</a> <a href="#ref-for-authdata-flags-at④">(5)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-flags-ed">
+   <b><a href="#authdata-flags-ed">#authdata-flags-ed</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-flags-ed">6.1. Authenticator Data</a> <a href="#ref-for-authdata-flags-ed①">(2)</a> <a href="#ref-for-authdata-flags-ed②">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-signcount">
+   <b><a href="#authdata-signcount">#authdata-signcount</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-signcount">4. Terminology</a>
+    <li><a href="#ref-for-authdata-signcount①">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-authdata-signcount②">(2)</a> <a href="#ref-for-authdata-signcount③">(3)</a> <a href="#ref-for-authdata-signcount④">(4)</a>
+    <li><a href="#ref-for-authdata-signcount⑤">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-signcount⑥">7.2. Verifying an Authentication Assertion</a> <a href="#ref-for-authdata-signcount⑦">(2)</a> <a href="#ref-for-authdata-signcount⑧">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-attestedcredentialdata">
+   <b><a href="#authdata-attestedcredentialdata">#authdata-attestedcredentialdata</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-attestedcredentialdata">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata①">5.2.1.1. Easily accessing credential data</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata②">6.1. Authenticator Data</a> <a href="#ref-for-authdata-attestedcredentialdata③">(2)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata④">6.1.2. FIDO U2F Signature Format Compatibility</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata⑤">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata⑥">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata⑦">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata⑧">8.3. TPM Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata⑨">8.4. Android Key Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata①⓪">8.6. FIDO U2F Attestation Statement Format</a> <a href="#ref-for-authdata-attestedcredentialdata①①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="authdata-extensions">
+   <b><a href="#authdata-extensions">#authdata-extensions</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-authdata-extensions">6.1. Authenticator Data</a> <a href="#ref-for-authdata-extensions①">(2)</a> <a href="#ref-for-authdata-extensions②">(3)</a> <a href="#ref-for-authdata-extensions③">(4)</a>
+    <li><a href="#ref-for-authdata-extensions④">6.1.2. FIDO U2F Signature Format Compatibility</a>
+    <li><a href="#ref-for-authdata-extensions⑤">6.3.2. The authenticatorMakeCredential Operation</a>
+    <li><a href="#ref-for-authdata-extensions⑥">6.3.3. The authenticatorGetAssertion Operation</a>
+    <li><a href="#ref-for-authdata-extensions⑦">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-extensions⑧">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-authdata-extensions⑨">9.5. Authenticator Extension Processing</a> <a href="#ref-for-authdata-extensions①⓪">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure">
@@ -11852,9 +13335,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-signature-counter②">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-signature-counter③">(2)</a> <a href="#ref-for-signature-counter④">(3)</a> <a href="#ref-for-signature-counter⑤">(4)</a> <a href="#ref-for-signature-counter⑥">(5)</a> <a href="#ref-for-signature-counter⑦">(6)</a> <a href="#ref-for-signature-counter⑧">(7)</a> <a href="#ref-for-signature-counter⑨">(8)</a> <a href="#ref-for-signature-counter①⓪">(9)</a> <a href="#ref-for-signature-counter①①">(10)</a> <a href="#ref-for-signature-counter①②">(11)</a> <a href="#ref-for-signature-counter①③">(12)</a>
     <li><a href="#ref-for-signature-counter①④">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-signature-counter①⑤">(2)</a> <a href="#ref-for-signature-counter①⑥">(3)</a> <a href="#ref-for-signature-counter①⑦">(4)</a> <a href="#ref-for-signature-counter①⑧">(5)</a> <a href="#ref-for-signature-counter①⑨">(6)</a>
     <li><a href="#ref-for-signature-counter②⓪">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-signature-counter②①">(2)</a> <a href="#ref-for-signature-counter②②">(3)</a> <a href="#ref-for-signature-counter②③">(4)</a>
-    <li><a href="#ref-for-signature-counter②④">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-signature-counter②⑤">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-signature-counter②⑥">11.5. Add Credential</a> <a href="#ref-for-signature-counter②⑦">(2)</a>
+    <li><a href="#ref-for-signature-counter②④">11.5. Add Credential</a> <a href="#ref-for-signature-counter②⑤">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator-type">
@@ -11938,7 +13419,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-roaming-authenticators⑦">6.1.3. Credential Backup State</a> <a href="#ref-for-roaming-authenticators⑧">(2)</a>
     <li><a href="#ref-for-roaming-authenticators⑨">6.2. Authenticator Taxonomy</a> <a href="#ref-for-roaming-authenticators①⓪">(2)</a> <a href="#ref-for-roaming-authenticators①①">(3)</a> <a href="#ref-for-roaming-authenticators①②">(4)</a> <a href="#ref-for-roaming-authenticators①③">(5)</a> <a href="#ref-for-roaming-authenticators①④">(6)</a> <a href="#ref-for-roaming-authenticators①⑤">(7)</a>
     <li><a href="#ref-for-roaming-authenticators①⑥">6.2.1. Authenticator Attachment Modality</a> <a href="#ref-for-roaming-authenticators①⑦">(2)</a> <a href="#ref-for-roaming-authenticators①⑧">(3)</a> <a href="#ref-for-roaming-authenticators①⑨">(4)</a> <a href="#ref-for-roaming-authenticators②⓪">(5)</a> <a href="#ref-for-roaming-authenticators②①">(6)</a> <a href="#ref-for-roaming-authenticators②②">(7)</a> <a href="#ref-for-roaming-authenticators②③">(8)</a>
-    <li><a href="#ref-for-roaming-authenticators②④">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-roaming-authenticators②④">10.1.5. Large blob storage extension (largeBlob)</a>
     <li><a href="#ref-for-roaming-authenticators②⑤">13.2. Physical Proximity between Client and Authenticator</a> <a href="#ref-for-roaming-authenticators②⑥">(2)</a>
     <li><a href="#ref-for-roaming-authenticators②⑦">15. Accessibility Considerations</a> <a href="#ref-for-roaming-authenticators②⑧">(2)</a>
    </ul>
@@ -12063,14 +13544,15 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authenticatormakecredential①⑥">9. WebAuthn Extensions</a>
     <li><a href="#ref-for-authenticatormakecredential①⑦">9.2. Defining Extensions</a>
     <li><a href="#ref-for-authenticatormakecredential①⑧">9.5. Authenticator Extension Processing</a>
-    <li><a href="#ref-for-authenticatormakecredential①⑨">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-authenticatormakecredential①⑨">10.1.3. Credential Properties Extension (credProps)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticatorgetassertion">
    <b><a href="#authenticatorgetassertion">#authenticatorgetassertion</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-authenticatorgetassertion">4. Terminology</a> <a href="#ref-for-authenticatorgetassertion①">(2)</a> <a href="#ref-for-authenticatorgetassertion②">(3)</a>
-    <li><a href="#ref-for-authenticatorgetassertion③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-authenticatorgetassertion④">(2)</a> <a href="#ref-for-authenticatorgetassertion⑤">(3)</a> <a href="#ref-for-authenticatorgetassertion⑥">(4)</a>
+    <li><a href="#ref-for-authenticatorgetassertion③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-authenticatorgetassertion④">5.1.4.2. Issuing a Credential Request to an Authenticator</a> <a href="#ref-for-authenticatorgetassertion⑤">(2)</a> <a href="#ref-for-authenticatorgetassertion⑥">(3)</a>
     <li><a href="#ref-for-authenticatorgetassertion⑦">6. WebAuthn Authenticator Model</a>
     <li><a href="#ref-for-authenticatorgetassertion⑧">6.1. Authenticator Data</a>
     <li><a href="#ref-for-authenticatorgetassertion⑨">6.1.1. Signature Counter Considerations</a> <a href="#ref-for-authenticatorgetassertion①⓪">(2)</a> <a href="#ref-for-authenticatorgetassertion①①">(3)</a> <a href="#ref-for-authenticatorgetassertion①②">(4)</a>
@@ -12079,7 +13561,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authenticatorgetassertion①⑥">9. WebAuthn Extensions</a>
     <li><a href="#ref-for-authenticatorgetassertion①⑦">9.2. Defining Extensions</a>
     <li><a href="#ref-for-authenticatorgetassertion①⑧">9.5. Authenticator Extension Processing</a>
-    <li><a href="#ref-for-authenticatorgetassertion①⑨">10.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-authenticatorgetassertion①⑨">10.1.1. FIDO AppID Extension (appid)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticatorcancel">
@@ -12091,6 +13573,37 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authenticatorcancel①②">6.3.3. The authenticatorGetAssertion Operation</a>
    </ul>
   </aside>
+  <aside class="dfn-panel" data-for="silentcredentialdiscovery">
+   <b><a href="#silentcredentialdiscovery">#silentcredentialdiscovery</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-silentcredentialdiscovery">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-silentcredentialdiscovery①">(2)</a> <a href="#ref-for-silentcredentialdiscovery②">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="discoverablecredentialmetadata">
+   <b><a href="#discoverablecredentialmetadata">#discoverablecredentialmetadata</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-discoverablecredentialmetadata">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-discoverablecredentialmetadata①">(2)</a>
+    <li><a href="#ref-for-discoverablecredentialmetadata②">6.3.5. The silentCredentialDiscovery operation</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="discoverablecredentialmetadata-type">
+   <b><a href="#discoverablecredentialmetadata-type">#discoverablecredentialmetadata-type</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-discoverablecredentialmetadata-type">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="discoverablecredentialmetadata-id">
+   <b><a href="#discoverablecredentialmetadata-id">#discoverablecredentialmetadata-id</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-discoverablecredentialmetadata-id">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="discoverablecredentialmetadata-otherui">
+   <b><a href="#discoverablecredentialmetadata-otherui">#discoverablecredentialmetadata-otherui</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-discoverablecredentialmetadata-otherui">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
+   </ul>
+  </aside>
   <aside class="dfn-panel" data-for="attestation-object">
    <b><a href="#attestation-object">#attestation-object</a></b><b>Referenced in:</b>
    <ul>
@@ -12110,20 +13623,20 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="attestation-statement">
    <b><a href="#attestation-statement">#attestation-statement</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-attestation-statement">4. Terminology</a> <a href="#ref-for-attestation-statement①">(2)</a>
-    <li><a href="#ref-for-attestation-statement②">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-attestation-statement③">(2)</a>
-    <li><a href="#ref-for-attestation-statement④">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-attestation-statement⑤">(2)</a> <a href="#ref-for-attestation-statement⑥">(3)</a>
-    <li><a href="#ref-for-attestation-statement⑦">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-attestation-statement⑧">(2)</a> <a href="#ref-for-attestation-statement⑨">(3)</a> <a href="#ref-for-attestation-statement①⓪">(4)</a> <a href="#ref-for-attestation-statement①①">(5)</a> <a href="#ref-for-attestation-statement①②">(6)</a> <a href="#ref-for-attestation-statement①③">(7)</a> <a href="#ref-for-attestation-statement①④">(8)</a> <a href="#ref-for-attestation-statement①⑤">(9)</a>
-    <li><a href="#ref-for-attestation-statement①⑥">6.2.3. Authentication Factor Capability</a>
-    <li><a href="#ref-for-attestation-statement①⑦">6.5. Attestation</a> <a href="#ref-for-attestation-statement①⑧">(2)</a> <a href="#ref-for-attestation-statement①⑨">(3)</a> <a href="#ref-for-attestation-statement②⓪">(4)</a> <a href="#ref-for-attestation-statement②①">(5)</a> <a href="#ref-for-attestation-statement②②">(6)</a> <a href="#ref-for-attestation-statement②③">(7)</a> <a href="#ref-for-attestation-statement②④">(8)</a>
-    <li><a href="#ref-for-attestation-statement②⑤">6.5.2. Attestation Statement Formats</a> <a href="#ref-for-attestation-statement②⑥">(2)</a> <a href="#ref-for-attestation-statement②⑦">(3)</a> <a href="#ref-for-attestation-statement②⑧">(4)</a>
-    <li><a href="#ref-for-attestation-statement②⑨">6.5.3. Attestation Types</a> <a href="#ref-for-attestation-statement③⓪">(2)</a> <a href="#ref-for-attestation-statement③①">(3)</a> <a href="#ref-for-attestation-statement③②">(4)</a> <a href="#ref-for-attestation-statement③③">(5)</a> <a href="#ref-for-attestation-statement③④">(6)</a>
-    <li><a href="#ref-for-attestation-statement③⑤">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-attestation-statement③⑥">8.7. None Attestation Statement Format</a>
-    <li><a href="#ref-for-attestation-statement③⑦">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a>
-    <li><a href="#ref-for-attestation-statement③⑧">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
-    <li><a href="#ref-for-attestation-statement③⑨">13.4.4. Attestation Limitations</a> <a href="#ref-for-attestation-statement④⓪">(2)</a> <a href="#ref-for-attestation-statement④①">(3)</a>
-    <li><a href="#ref-for-attestation-statement④②">14.1. De-anonymization Prevention Measures</a>
+    <li><a href="#ref-for-attestation-statement">4. Terminology</a> <a href="#ref-for-attestation-statement①">(2)</a> <a href="#ref-for-attestation-statement②">(3)</a>
+    <li><a href="#ref-for-attestation-statement③">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-attestation-statement④">(2)</a>
+    <li><a href="#ref-for-attestation-statement⑤">5.2.1. Information About Public Key Credential (interface AuthenticatorAttestationResponse)</a> <a href="#ref-for-attestation-statement⑥">(2)</a> <a href="#ref-for-attestation-statement⑦">(3)</a>
+    <li><a href="#ref-for-attestation-statement⑧">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a> <a href="#ref-for-attestation-statement⑨">(2)</a> <a href="#ref-for-attestation-statement①⓪">(3)</a> <a href="#ref-for-attestation-statement①①">(4)</a> <a href="#ref-for-attestation-statement①②">(5)</a> <a href="#ref-for-attestation-statement①③">(6)</a> <a href="#ref-for-attestation-statement①④">(7)</a> <a href="#ref-for-attestation-statement①⑤">(8)</a> <a href="#ref-for-attestation-statement①⑥">(9)</a>
+    <li><a href="#ref-for-attestation-statement①⑦">6.2.3. Authentication Factor Capability</a>
+    <li><a href="#ref-for-attestation-statement①⑧">6.5. Attestation</a> <a href="#ref-for-attestation-statement①⑨">(2)</a> <a href="#ref-for-attestation-statement②⓪">(3)</a> <a href="#ref-for-attestation-statement②①">(4)</a> <a href="#ref-for-attestation-statement②②">(5)</a> <a href="#ref-for-attestation-statement②③">(6)</a> <a href="#ref-for-attestation-statement②④">(7)</a> <a href="#ref-for-attestation-statement②⑤">(8)</a>
+    <li><a href="#ref-for-attestation-statement②⑥">6.5.2. Attestation Statement Formats</a> <a href="#ref-for-attestation-statement②⑦">(2)</a> <a href="#ref-for-attestation-statement②⑧">(3)</a> <a href="#ref-for-attestation-statement②⑨">(4)</a>
+    <li><a href="#ref-for-attestation-statement③⓪">6.5.3. Attestation Types</a> <a href="#ref-for-attestation-statement③①">(2)</a> <a href="#ref-for-attestation-statement③②">(3)</a> <a href="#ref-for-attestation-statement③③">(4)</a> <a href="#ref-for-attestation-statement③④">(5)</a> <a href="#ref-for-attestation-statement③⑤">(6)</a>
+    <li><a href="#ref-for-attestation-statement③⑥">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-attestation-statement③⑦">8.7. None Attestation Statement Format</a>
+    <li><a href="#ref-for-attestation-statement③⑧">13.3.2. Attestation Certificate and Attestation Certificate CA Compromise</a>
+    <li><a href="#ref-for-attestation-statement③⑨">13.4.1. Security Benefits for WebAuthn Relying Parties</a>
+    <li><a href="#ref-for-attestation-statement④⓪">13.4.4. Attestation Limitations</a> <a href="#ref-for-attestation-statement④①">(2)</a> <a href="#ref-for-attestation-statement④②">(3)</a>
+    <li><a href="#ref-for-attestation-statement④③">14.1. De-anonymization Prevention Measures</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="attestation-statement-format">
@@ -12164,42 +13677,42 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-attested-credential-data①①">6.5.1. Attested Credential Data</a> <a href="#ref-for-attested-credential-data①②">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="aaguid">
-   <b><a href="#aaguid">#aaguid</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="authdata-attestedcredentialdata-aaguid">
+   <b><a href="#authdata-attestedcredentialdata-aaguid">#authdata-attestedcredentialdata-aaguid</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-aaguid">4. Terminology</a>
-    <li><a href="#ref-for-aaguid①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-aaguid②">(2)</a> <a href="#ref-for-aaguid③">(3)</a> <a href="#ref-for-aaguid④">(4)</a>
-    <li><a href="#ref-for-aaguid⑤">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>
-    <li><a href="#ref-for-aaguid⑥">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-aaguid⑦">8.2. Packed Attestation Statement Format</a>
-    <li><a href="#ref-for-aaguid⑧">8.3. TPM Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-aaguid">4. Terminology</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-aaguid①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-authdata-attestedcredentialdata-aaguid②">(2)</a> <a href="#ref-for-authdata-attestedcredentialdata-aaguid③">(3)</a> <a href="#ref-for-authdata-attestedcredentialdata-aaguid④">(4)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-aaguid⑤">5.4.7. Attestation Conveyance Preference Enumeration (enum AttestationConveyancePreference)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-aaguid⑥">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-aaguid⑦">8.2. Packed Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-aaguid⑧">8.3. TPM Attestation Statement Format</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="credentialidlength">
-   <b><a href="#credentialidlength">#credentialidlength</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="authdata-attestedcredentialdata-credentialidlength">
+   <b><a href="#authdata-attestedcredentialdata-credentialidlength">#authdata-attestedcredentialdata-credentialidlength</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-credentialidlength">6.1. Authenticator Data</a> <a href="#ref-for-credentialidlength①">(2)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialidlength">6.1. Authenticator Data</a> <a href="#ref-for-authdata-attestedcredentialdata-credentialidlength①">(2)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="credentialid">
-   <b><a href="#credentialid">#credentialid</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="authdata-attestedcredentialdata-credentialid">
+   <b><a href="#authdata-attestedcredentialdata-credentialid">#authdata-attestedcredentialdata-credentialid</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-credentialid">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-credentialid①">6.1. Authenticator Data</a> <a href="#ref-for-credentialid②">(2)</a>
-    <li><a href="#ref-for-credentialid③">6.5.1. Attested Credential Data</a>
-    <li><a href="#ref-for-credentialid④">7.1. Registering a New Credential</a> <a href="#ref-for-credentialid⑤">(2)</a> <a href="#ref-for-credentialid⑥">(3)</a> <a href="#ref-for-credentialid⑦">(4)</a> <a href="#ref-for-credentialid⑧">(5)</a> <a href="#ref-for-credentialid⑨">(6)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialid">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialid①">6.1. Authenticator Data</a> <a href="#ref-for-authdata-attestedcredentialdata-credentialid②">(2)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialid③">6.5.1. Attested Credential Data</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialid④">7.1. Registering a New Credential</a> <a href="#ref-for-authdata-attestedcredentialdata-credentialid⑤">(2)</a> <a href="#ref-for-authdata-attestedcredentialdata-credentialid⑥">(3)</a>
    </ul>
   </aside>
-  <aside class="dfn-panel" data-for="credentialpublickey">
-   <b><a href="#credentialpublickey">#credentialpublickey</a></b><b>Referenced in:</b>
+  <aside class="dfn-panel" data-for="authdata-attestedcredentialdata-credentialpublickey">
+   <b><a href="#authdata-attestedcredentialdata-credentialpublickey">#authdata-attestedcredentialdata-credentialpublickey</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-credentialpublickey">5.2.1.1. Easily accessing credential data</a>
-    <li><a href="#ref-for-credentialpublickey①">6.1. Authenticator Data</a> <a href="#ref-for-credentialpublickey②">(2)</a> <a href="#ref-for-credentialpublickey③">(3)</a>
-    <li><a href="#ref-for-credentialpublickey④">6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format</a>
-    <li><a href="#ref-for-credentialpublickey⑤">7.1. Registering a New Credential</a> <a href="#ref-for-credentialpublickey⑥">(2)</a>
-    <li><a href="#ref-for-credentialpublickey⑦">8.2. Packed Attestation Statement Format</a>
-    <li><a href="#ref-for-credentialpublickey⑧">8.3. TPM Attestation Statement Format</a>
-    <li><a href="#ref-for-credentialpublickey⑨">8.4. Android Key Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey">5.2.1.1. Easily accessing credential data</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey①">6.1. Authenticator Data</a> <a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey②">(2)</a> <a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey③">(3)</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey④">6.5.1.1. Examples of credentialPublicKey Values Encoded in COSE_Key Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey⑤">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey⑥">8.2. Packed Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey⑦">8.3. TPM Attestation Statement Format</a>
+    <li><a href="#ref-for-authdata-attestedcredentialdata-credentialpublickey⑧">8.4. Android Key Attestation Statement Format</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="signing-procedure">
@@ -12366,15 +13879,16 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="webauthn-extensions">
    <b><a href="#webauthn-extensions">#webauthn-extensions</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-webauthn-extensions">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-webauthn-extensions①">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-webauthn-extensions②">5.7. WebAuthn Extensions Inputs and Outputs</a>
-    <li><a href="#ref-for-webauthn-extensions③">5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)</a>
-    <li><a href="#ref-for-webauthn-extensions④">5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)</a>
-    <li><a href="#ref-for-webauthn-extensions⑤">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
-    <li><a href="#ref-for-webauthn-extensions⑥">5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)</a>
-    <li><a href="#ref-for-webauthn-extensions⑦">8.1. Attestation Statement Format Identifiers</a>
-    <li><a href="#ref-for-webauthn-extensions⑧">9. WebAuthn Extensions</a> <a href="#ref-for-webauthn-extensions⑨">(2)</a> <a href="#ref-for-webauthn-extensions①⓪">(3)</a>
+    <li><a href="#ref-for-webauthn-extensions">4. Terminology</a>
+    <li><a href="#ref-for-webauthn-extensions①">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-webauthn-extensions②">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-webauthn-extensions③">5.7. WebAuthn Extensions Inputs and Outputs</a>
+    <li><a href="#ref-for-webauthn-extensions④">5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)</a>
+    <li><a href="#ref-for-webauthn-extensions⑤">5.7.2. Authentication Extensions Client Outputs (dictionary AuthenticationExtensionsClientOutputs)</a>
+    <li><a href="#ref-for-webauthn-extensions⑥">5.7.3. Authentication Extensions Authenticator Inputs (CDDL type AuthenticationExtensionsAuthenticatorInputs)</a>
+    <li><a href="#ref-for-webauthn-extensions⑦">5.7.4. Authentication Extensions Authenticator Outputs (CDDL type AuthenticationExtensionsAuthenticatorOutputs)</a>
+    <li><a href="#ref-for-webauthn-extensions⑧">8.1. Attestation Statement Format Identifiers</a>
+    <li><a href="#ref-for-webauthn-extensions⑨">9. WebAuthn Extensions</a> <a href="#ref-for-webauthn-extensions①⓪">(2)</a> <a href="#ref-for-webauthn-extensions①①">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="registration-extension">
@@ -12383,12 +13897,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-registration-extension">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-registration-extension①">5.7. WebAuthn Extensions Inputs and Outputs</a>
     <li><a href="#ref-for-registration-extension②">9. WebAuthn Extensions</a> <a href="#ref-for-registration-extension③">(2)</a> <a href="#ref-for-registration-extension④">(3)</a> <a href="#ref-for-registration-extension⑤">(4)</a> <a href="#ref-for-registration-extension⑥">(5)</a> <a href="#ref-for-registration-extension⑦">(6)</a>
-    <li><a href="#ref-for-registration-extension⑧">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-    <li><a href="#ref-for-registration-extension⑨">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-registration-extension①⓪">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-registration-extension①①">(2)</a>
-    <li><a href="#ref-for-registration-extension①②">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-registration-extension①③">(2)</a> <a href="#ref-for-registration-extension①④">(3)</a> <a href="#ref-for-registration-extension①⑤">(4)</a> <a href="#ref-for-registration-extension①⑥">(5)</a> <a href="#ref-for-registration-extension①⑦">(6)</a> <a href="#ref-for-registration-extension①⑧">(7)</a>
-    <li><a href="#ref-for-registration-extension①⑨">12.3. WebAuthn Extension Identifier Registrations Updates</a>
-    <li><a href="#ref-for-registration-extension②⓪">12.4. WebAuthn Extension Identifier Registrations</a> <a href="#ref-for-registration-extension②①">(2)</a>
+    <li><a href="#ref-for-registration-extension⑧">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
+    <li><a href="#ref-for-registration-extension⑨">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-registration-extension①⓪">(2)</a>
+    <li><a href="#ref-for-registration-extension①①">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-registration-extension①②">(2)</a> <a href="#ref-for-registration-extension①③">(3)</a>
+    <li><a href="#ref-for-registration-extension①④">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-registration-extension①⑤">(2)</a> <a href="#ref-for-registration-extension①⑥">(3)</a> <a href="#ref-for-registration-extension①⑦">(4)</a> <a href="#ref-for-registration-extension①⑧">(5)</a> <a href="#ref-for-registration-extension①⑨">(6)</a> <a href="#ref-for-registration-extension②⓪">(7)</a>
+    <li><a href="#ref-for-registration-extension②①">10.2.1. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-registration-extension②②">12.3. WebAuthn Extension Identifier Registrations Updates</a>
+    <li><a href="#ref-for-registration-extension②③">12.4. WebAuthn Extension Identifier Registrations</a> <a href="#ref-for-registration-extension②④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authentication-extension">
@@ -12397,11 +13912,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authentication-extension">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-authentication-extension①">5.7. WebAuthn Extensions Inputs and Outputs</a>
     <li><a href="#ref-for-authentication-extension②">9. WebAuthn Extensions</a> <a href="#ref-for-authentication-extension③">(2)</a> <a href="#ref-for-authentication-extension④">(3)</a> <a href="#ref-for-authentication-extension⑤">(4)</a> <a href="#ref-for-authentication-extension⑥">(5)</a> <a href="#ref-for-authentication-extension⑦">(6)</a>
-    <li><a href="#ref-for-authentication-extension⑧">10.1. FIDO AppID Extension (appid)</a>
-    <li><a href="#ref-for-authentication-extension⑨">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-authentication-extension①⓪">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-authentication-extension①①">(2)</a> <a href="#ref-for-authentication-extension①②">(3)</a> <a href="#ref-for-authentication-extension①③">(4)</a> <a href="#ref-for-authentication-extension①④">(5)</a> <a href="#ref-for-authentication-extension①⑤">(6)</a>
-    <li><a href="#ref-for-authentication-extension①⑥">12.3. WebAuthn Extension Identifier Registrations Updates</a> <a href="#ref-for-authentication-extension①⑦">(2)</a>
-    <li><a href="#ref-for-authentication-extension①⑧">12.4. WebAuthn Extension Identifier Registrations</a>
+    <li><a href="#ref-for-authentication-extension⑧">10.1.1. FIDO AppID Extension (appid)</a>
+    <li><a href="#ref-for-authentication-extension⑨">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-authentication-extension①⓪">(2)</a> <a href="#ref-for-authentication-extension①①">(3)</a>
+    <li><a href="#ref-for-authentication-extension①②">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-authentication-extension①③">(2)</a> <a href="#ref-for-authentication-extension①④">(3)</a> <a href="#ref-for-authentication-extension①⑤">(4)</a> <a href="#ref-for-authentication-extension①⑥">(5)</a> <a href="#ref-for-authentication-extension①⑦">(6)</a>
+    <li><a href="#ref-for-authentication-extension①⑧">10.2.1. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-authentication-extension①⑨">12.3. WebAuthn Extension Identifier Registrations Updates</a> <a href="#ref-for-authentication-extension②⓪">(2)</a>
+    <li><a href="#ref-for-authentication-extension②①">12.4. WebAuthn Extension Identifier Registrations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="client-extension">
@@ -12414,9 +13930,12 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-client-extension④">9. WebAuthn Extensions</a>
     <li><a href="#ref-for-client-extension⑤">9.2. Defining Extensions</a>
     <li><a href="#ref-for-client-extension⑥">9.4. Client Extension Processing</a>
-    <li><a href="#ref-for-client-extension⑦">10.4. Credential Properties Extension (credProps)</a>
-    <li><a href="#ref-for-client-extension⑧">10.5. Large blob storage extension (largeBlob)</a>
-    <li><a href="#ref-for-client-extension⑨">12.4. WebAuthn Extension Identifier Registrations</a> <a href="#ref-for-client-extension①⓪">(2)</a>
+    <li><a href="#ref-for-client-extension⑦">10.1. Client Extensions</a>
+    <li><a href="#ref-for-client-extension⑧">10.1.3. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-client-extension⑨">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-client-extension①⓪">(2)</a>
+    <li><a href="#ref-for-client-extension①①">10.1.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-client-extension①②">10.2. Authenticator Extensions</a>
+    <li><a href="#ref-for-client-extension①③">12.4. WebAuthn Extension Identifier Registrations</a> <a href="#ref-for-client-extension①④">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator-extension">
@@ -12424,14 +13943,16 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
    <ul>
     <li><a href="#ref-for-authenticator-extension">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-authenticator-extension①">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-authenticator-extension②">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-authenticator-extension③">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-authenticator-extension④">9. WebAuthn Extensions</a> <a href="#ref-for-authenticator-extension⑤">(2)</a> <a href="#ref-for-authenticator-extension⑥">(3)</a>
-    <li><a href="#ref-for-authenticator-extension⑦">9.2. Defining Extensions</a> <a href="#ref-for-authenticator-extension⑧">(2)</a>
-    <li><a href="#ref-for-authenticator-extension⑨">9.3. Extending Request Parameters</a>
-    <li><a href="#ref-for-authenticator-extension①⓪">9.5. Authenticator Extension Processing</a>
-    <li><a href="#ref-for-authenticator-extension①①">11.1.1. Authenticator Extension Capabilities</a> <a href="#ref-for-authenticator-extension①②">(2)</a> <a href="#ref-for-authenticator-extension①③">(3)</a>
-    <li><a href="#ref-for-authenticator-extension①④">11.2. Virtual Authenticators</a> <a href="#ref-for-authenticator-extension①⑤">(2)</a>
+    <li><a href="#ref-for-authenticator-extension②">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-authenticator-extension③">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-authenticator-extension④">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-authenticator-extension⑤">9. WebAuthn Extensions</a> <a href="#ref-for-authenticator-extension⑥">(2)</a> <a href="#ref-for-authenticator-extension⑦">(3)</a>
+    <li><a href="#ref-for-authenticator-extension⑧">9.2. Defining Extensions</a> <a href="#ref-for-authenticator-extension⑨">(2)</a>
+    <li><a href="#ref-for-authenticator-extension①⓪">9.3. Extending Request Parameters</a>
+    <li><a href="#ref-for-authenticator-extension①①">9.5. Authenticator Extension Processing</a>
+    <li><a href="#ref-for-authenticator-extension①②">10.2. Authenticator Extensions</a>
+    <li><a href="#ref-for-authenticator-extension①③">11.1.1. Authenticator Extension Capabilities</a> <a href="#ref-for-authenticator-extension①④">(2)</a> <a href="#ref-for-authenticator-extension①⑤">(3)</a>
+    <li><a href="#ref-for-authenticator-extension①⑥">11.2. Virtual Authenticators</a> <a href="#ref-for-authenticator-extension①⑦">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="extension-identifier">
@@ -12440,32 +13961,35 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-extension-identifier">5.1. PublicKeyCredential Interface</a>
     <li><a href="#ref-for-extension-identifier①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a>
     <li><a href="#ref-for-extension-identifier②">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a>
-    <li><a href="#ref-for-extension-identifier③">6.1. Authenticator Data</a>
-    <li><a href="#ref-for-extension-identifier④">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-extension-identifier⑤">(2)</a>
-    <li><a href="#ref-for-extension-identifier⑥">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-extension-identifier⑦">(2)</a>
-    <li><a href="#ref-for-extension-identifier⑧">9. WebAuthn Extensions</a> <a href="#ref-for-extension-identifier⑨">(2)</a>
-    <li><a href="#ref-for-extension-identifier①⓪">9.2. Defining Extensions</a>
-    <li><a href="#ref-for-extension-identifier①①">9.3. Extending Request Parameters</a> <a href="#ref-for-extension-identifier①②">(2)</a> <a href="#ref-for-extension-identifier①③">(3)</a> <a href="#ref-for-extension-identifier①④">(4)</a>
-    <li><a href="#ref-for-extension-identifier①⑤">9.4. Client Extension Processing</a> <a href="#ref-for-extension-identifier①⑥">(2)</a>
-    <li><a href="#ref-for-extension-identifier①⑦">9.5. Authenticator Extension Processing</a> <a href="#ref-for-extension-identifier①⑧">(2)</a>
-    <li><a href="#ref-for-extension-identifier①⑨">11.2. Virtual Authenticators</a>
-    <li><a href="#ref-for-extension-identifier②⓪">11.3. Add Virtual Authenticator</a> <a href="#ref-for-extension-identifier②①">(2)</a>
-    <li><a href="#ref-for-extension-identifier②②">12.3. WebAuthn Extension Identifier Registrations Updates</a>
-    <li><a href="#ref-for-extension-identifier②③">12.4. WebAuthn Extension Identifier Registrations</a>
+    <li><a href="#ref-for-extension-identifier③">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-extension-identifier④">6.1. Authenticator Data</a>
+    <li><a href="#ref-for-extension-identifier⑤">6.3.2. The authenticatorMakeCredential Operation</a> <a href="#ref-for-extension-identifier⑥">(2)</a>
+    <li><a href="#ref-for-extension-identifier⑦">6.3.3. The authenticatorGetAssertion Operation</a> <a href="#ref-for-extension-identifier⑧">(2)</a>
+    <li><a href="#ref-for-extension-identifier⑨">9. WebAuthn Extensions</a> <a href="#ref-for-extension-identifier①⓪">(2)</a>
+    <li><a href="#ref-for-extension-identifier①①">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-extension-identifier①②">9.3. Extending Request Parameters</a> <a href="#ref-for-extension-identifier①③">(2)</a> <a href="#ref-for-extension-identifier①④">(3)</a> <a href="#ref-for-extension-identifier①⑤">(4)</a>
+    <li><a href="#ref-for-extension-identifier①⑥">9.4. Client Extension Processing</a> <a href="#ref-for-extension-identifier①⑦">(2)</a>
+    <li><a href="#ref-for-extension-identifier①⑧">9.5. Authenticator Extension Processing</a> <a href="#ref-for-extension-identifier①⑨">(2)</a>
+    <li><a href="#ref-for-extension-identifier②⓪">11.2. Virtual Authenticators</a>
+    <li><a href="#ref-for-extension-identifier②①">11.3. Add Virtual Authenticator</a> <a href="#ref-for-extension-identifier②②">(2)</a>
+    <li><a href="#ref-for-extension-identifier②③">12.3. WebAuthn Extension Identifier Registrations Updates</a>
+    <li><a href="#ref-for-extension-identifier②④">12.4. WebAuthn Extension Identifier Registrations</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="client-extension-input">
    <b><a href="#client-extension-input">#client-extension-input</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-client-extension-input">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
-    <li><a href="#ref-for-client-extension-input①">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
-    <li><a href="#ref-for-client-extension-input②">5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)</a>
-    <li><a href="#ref-for-client-extension-input③">7.1. Registering a New Credential</a>
-    <li><a href="#ref-for-client-extension-input④">7.2. Verifying an Authentication Assertion</a>
-    <li><a href="#ref-for-client-extension-input⑤">9. WebAuthn Extensions</a> <a href="#ref-for-client-extension-input⑥">(2)</a>
-    <li><a href="#ref-for-client-extension-input⑦">9.2. Defining Extensions</a>
-    <li><a href="#ref-for-client-extension-input⑧">9.3. Extending Request Parameters</a> <a href="#ref-for-client-extension-input⑨">(2)</a> <a href="#ref-for-client-extension-input①⓪">(3)</a> <a href="#ref-for-client-extension-input①①">(4)</a> <a href="#ref-for-client-extension-input①②">(5)</a> <a href="#ref-for-client-extension-input①③">(6)</a>
-    <li><a href="#ref-for-client-extension-input①④">9.4. Client Extension Processing</a> <a href="#ref-for-client-extension-input①⑤">(2)</a> <a href="#ref-for-client-extension-input①⑥">(3)</a> <a href="#ref-for-client-extension-input①⑦">(4)</a>
+    <li><a href="#ref-for-client-extension-input">5.1.8. Deserialize Registration ceremony options - PublicKeyCredential’s parseCreationOptionsFromJSON() Method</a>
+    <li><a href="#ref-for-client-extension-input①">5.1.9. Deserialize Authentication ceremony options - PublicKeyCredential’s parseRequestOptionsFromJSON() Methods</a>
+    <li><a href="#ref-for-client-extension-input②">5.4. Options for Credential Creation (dictionary PublicKeyCredentialCreationOptions)</a>
+    <li><a href="#ref-for-client-extension-input③">5.5. Options for Assertion Generation (dictionary PublicKeyCredentialRequestOptions)</a>
+    <li><a href="#ref-for-client-extension-input④">5.7.1. Authentication Extensions Client Inputs (dictionary AuthenticationExtensionsClientInputs)</a>
+    <li><a href="#ref-for-client-extension-input⑤">7.1. Registering a New Credential</a>
+    <li><a href="#ref-for-client-extension-input⑥">7.2. Verifying an Authentication Assertion</a>
+    <li><a href="#ref-for-client-extension-input⑦">9. WebAuthn Extensions</a> <a href="#ref-for-client-extension-input⑧">(2)</a>
+    <li><a href="#ref-for-client-extension-input⑨">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-client-extension-input①⓪">9.3. Extending Request Parameters</a> <a href="#ref-for-client-extension-input①①">(2)</a> <a href="#ref-for-client-extension-input①②">(3)</a> <a href="#ref-for-client-extension-input①③">(4)</a> <a href="#ref-for-client-extension-input①④">(5)</a> <a href="#ref-for-client-extension-input①⑤">(6)</a>
+    <li><a href="#ref-for-client-extension-input①⑥">9.4. Client Extension Processing</a> <a href="#ref-for-client-extension-input①⑦">(2)</a> <a href="#ref-for-client-extension-input①⑧">(3)</a> <a href="#ref-for-client-extension-input①⑨">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator-extension-input">
@@ -12487,8 +14011,9 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-client-extension-processing">5.1. PublicKeyCredential Interface</a>
     <li><a href="#ref-for-client-extension-processing①">5.1.3. Create a New Credential - PublicKeyCredential’s [[Create]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client-extension-processing②">(2)</a>
     <li><a href="#ref-for-client-extension-processing③">5.1.4.1. PublicKeyCredential’s [[DiscoverFromExternalSource]](origin, options, sameOriginWithAncestors) Method</a> <a href="#ref-for-client-extension-processing④">(2)</a>
-    <li><a href="#ref-for-client-extension-processing⑤">9. WebAuthn Extensions</a> <a href="#ref-for-client-extension-processing⑥">(2)</a> <a href="#ref-for-client-extension-processing⑦">(3)</a> <a href="#ref-for-client-extension-processing⑧">(4)</a>
-    <li><a href="#ref-for-client-extension-processing⑨">9.2. Defining Extensions</a>
+    <li><a href="#ref-for-client-extension-processing⑤">5.1.4.2. Issuing a Credential Request to an Authenticator</a>
+    <li><a href="#ref-for-client-extension-processing⑥">9. WebAuthn Extensions</a> <a href="#ref-for-client-extension-processing⑦">(2)</a> <a href="#ref-for-client-extension-processing⑧">(3)</a> <a href="#ref-for-client-extension-processing⑨">(4)</a>
+    <li><a href="#ref-for-client-extension-processing①⓪">9.2. Defining Extensions</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="client-extension-output">
@@ -12503,7 +14028,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-client-extension-output①⓪">9. WebAuthn Extensions</a> <a href="#ref-for-client-extension-output①①">(2)</a>
     <li><a href="#ref-for-client-extension-output①②">9.2. Defining Extensions</a> <a href="#ref-for-client-extension-output①③">(2)</a> <a href="#ref-for-client-extension-output①④">(3)</a>
     <li><a href="#ref-for-client-extension-output①⑤">9.4. Client Extension Processing</a> <a href="#ref-for-client-extension-output①⑥">(2)</a> <a href="#ref-for-client-extension-output①⑦">(3)</a>
-    <li><a href="#ref-for-client-extension-output①⑧">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-client-extension-output①⑧">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator-extension-processing">
@@ -12530,7 +14055,7 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
     <li><a href="#ref-for-authenticator-extension-output①②">9.3. Extending Request Parameters</a>
     <li><a href="#ref-for-authenticator-extension-output①③">9.4. Client Extension Processing</a>
     <li><a href="#ref-for-authenticator-extension-output①④">9.5. Authenticator Extension Processing</a>
-    <li><a href="#ref-for-authenticator-extension-output①⑤">10.3. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-authenticator-extension-output①⑤">10.2.1. User Verification Method Extension (uvm)</a>
     <li><a href="#ref-for-authenticator-extension-output①⑥">11.2. Virtual Authenticators</a>
    </ul>
   </aside>
@@ -12544,35 +14069,13 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="dom-authenticationextensionsclientinputs-appid">
    <b><a href="#dom-authenticationextensionsclientinputs-appid">#dom-authenticationextensionsclientinputs-appid</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionsclientinputs-appid">10.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-dom-authenticationextensionsclientinputs-appid①">(2)</a> <a href="#ref-for-dom-authenticationextensionsclientinputs-appid②">(3)</a>
+    <li><a href="#ref-for-dom-authenticationextensionsclientinputs-appid">10.1.1. FIDO AppID Extension (appid)</a> <a href="#ref-for-dom-authenticationextensionsclientinputs-appid①">(2)</a> <a href="#ref-for-dom-authenticationextensionsclientinputs-appid②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionsclientinputs-appidexclude">
    <b><a href="#dom-authenticationextensionsclientinputs-appidexclude">#dom-authenticationextensionsclientinputs-appidexclude</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionsclientinputs-appidexclude">10.2. FIDO AppID Exclusion Extension (appidExclude)</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="user-verification-method">
-   <b><a href="#user-verification-method">#user-verification-method</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-user-verification-method">11.1.1. Authenticator Extension Capabilities</a>
-    <li><a href="#ref-for-user-verification-method①">11.2. Virtual Authenticators</a> <a href="#ref-for-user-verification-method②">(2)</a>
-    <li><a href="#ref-for-user-verification-method③">11.3. Add Virtual Authenticator</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="typedefdef-uvmentry">
-   <b><a href="#typedefdef-uvmentry">#typedefdef-uvmentry</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-typedefdef-uvmentry">10.3. User Verification Method Extension (uvm)</a>
-   </ul>
-  </aside>
-  <aside class="dfn-panel" data-for="typedefdef-uvmentries">
-   <b><a href="#typedefdef-uvmentries">#typedefdef-uvmentries</a></b><b>Referenced in:</b>
-   <ul>
-    <li><a href="#ref-for-typedefdef-uvmentries">10.3. User Verification Method Extension (uvm)</a>
-    <li><a href="#ref-for-typedefdef-uvmentries①">11.2. Virtual Authenticators</a>
-    <li><a href="#ref-for-typedefdef-uvmentries②">11.3. Add Virtual Authenticator</a>
+    <li><a href="#ref-for-dom-authenticationextensionsclientinputs-appidexclude">10.1.2. FIDO AppID Exclusion Extension (appidExclude)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="credprops">
@@ -12585,113 +14088,202 @@ <h2 class="no-num no-ref heading settled" id="issues-index"><span class="content
   <aside class="dfn-panel" data-for="dictdef-credentialpropertiesoutput">
    <b><a href="#dictdef-credentialpropertiesoutput">#dictdef-credentialpropertiesoutput</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-credentialpropertiesoutput">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-dictdef-credentialpropertiesoutput">10.1.3. Credential Properties Extension (credProps)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionsclientoutputs-credprops">
    <b><a href="#dom-authenticationextensionsclientoutputs-credprops">#dom-authenticationextensionsclientoutputs-credprops</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionsclientoutputs-credprops">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-dom-authenticationextensionsclientoutputs-credprops">10.1.3. Credential Properties Extension (credProps)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-credentialpropertiesoutput-rk">
    <b><a href="#dom-credentialpropertiesoutput-rk">#dom-credentialpropertiesoutput-rk</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-dom-credentialpropertiesoutput-rk">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
-    <li><a href="#ref-for-dom-credentialpropertiesoutput-rk①">10.4. Credential Properties Extension (credProps)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk②">(2)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk③">(3)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk④">(4)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk⑤">(5)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk⑥">(6)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk⑦">(7)</a>
+    <li><a href="#ref-for-dom-credentialpropertiesoutput-rk①">10.1.3. Credential Properties Extension (credProps)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk②">(2)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk③">(3)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk④">(4)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk⑤">(5)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk⑥">(6)</a> <a href="#ref-for-dom-credentialpropertiesoutput-rk⑦">(7)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="credentialpropertiesoutput-resident-key-credential-property">
    <b><a href="#credentialpropertiesoutput-resident-key-credential-property">#credentialpropertiesoutput-resident-key-credential-property</a></b><b>Referenced in:</b>
    <ul>
     <li><a href="#ref-for-credentialpropertiesoutput-resident-key-credential-property">5.4.6. Resident Key Requirement Enumeration (enum ResidentKeyRequirement)</a>
-    <li><a href="#ref-for-credentialpropertiesoutput-resident-key-credential-property①">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-credentialpropertiesoutput-resident-key-credential-property①">10.1.3. Credential Properties Extension (credProps)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="credentialpropertiesoutput-client-side-discoverable-credential-property">
    <b><a href="#credentialpropertiesoutput-client-side-discoverable-credential-property">#credentialpropertiesoutput-client-side-discoverable-credential-property</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">10.4. Credential Properties Extension (credProps)</a>
+    <li><a href="#ref-for-credentialpropertiesoutput-client-side-discoverable-credential-property">10.1.3. Credential Properties Extension (credProps)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="prf">
+   <b><a href="#prf">#prf</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-prf">10.1.4. Pseudo-random function extension (prf)</a>
+    <li><a href="#ref-for-prf①">11.1.1. Authenticator Extension Capabilities</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticationextensionsprfvalues">
+   <b><a href="#dictdef-authenticationextensionsprfvalues">#dictdef-authenticationextensionsprfvalues</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticationextensionsprfvalues">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dictdef-authenticationextensionsprfvalues①">(2)</a> <a href="#ref-for-dictdef-authenticationextensionsprfvalues②">(3)</a> <a href="#ref-for-dictdef-authenticationextensionsprfvalues③">(4)</a> <a href="#ref-for-dictdef-authenticationextensionsprfvalues④">(5)</a> <a href="#ref-for-dictdef-authenticationextensionsprfvalues⑤">(6)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsprfvalues-first">
+   <b><a href="#dom-authenticationextensionsprfvalues-first">#dom-authenticationextensionsprfvalues-first</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsprfvalues-first">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-authenticationextensionsprfvalues-first①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsprfvalues-second">
+   <b><a href="#dom-authenticationextensionsprfvalues-second">#dom-authenticationextensionsprfvalues-second</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsprfvalues-second">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-authenticationextensionsprfvalues-second①">(2)</a> <a href="#ref-for-dom-authenticationextensionsprfvalues-second②">(3)</a> <a href="#ref-for-dom-authenticationextensionsprfvalues-second③">(4)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticationextensionsprfinputs">
+   <b><a href="#dictdef-authenticationextensionsprfinputs">#dictdef-authenticationextensionsprfinputs</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticationextensionsprfinputs">10.1.4. Pseudo-random function extension (prf)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsprfinputs-eval">
+   <b><a href="#dom-authenticationextensionsprfinputs-eval">#dom-authenticationextensionsprfinputs-eval</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsprfinputs-eval">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval①">(2)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval②">(3)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval③">(4)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval④">(5)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval⑤">(6)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval⑥">(7)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval⑦">(8)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-eval⑧">(9)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsprfinputs-evalbycredential">
+   <b><a href="#dom-authenticationextensionsprfinputs-evalbycredential">#dom-authenticationextensionsprfinputs-evalbycredential</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsprfinputs-evalbycredential">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-evalbycredential①">(2)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-evalbycredential②">(3)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-evalbycredential③">(4)</a> <a href="#ref-for-dom-authenticationextensionsprfinputs-evalbycredential④">(5)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dictdef-authenticationextensionsprfoutputs">
+   <b><a href="#dictdef-authenticationextensionsprfoutputs">#dictdef-authenticationextensionsprfoutputs</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dictdef-authenticationextensionsprfoutputs">10.1.4. Pseudo-random function extension (prf)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsclientoutputs-prf">
+   <b><a href="#dom-authenticationextensionsclientoutputs-prf">#dom-authenticationextensionsclientoutputs-prf</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsclientoutputs-prf">10.1.4. Pseudo-random function extension (prf)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsprfoutputs-enabled">
+   <b><a href="#dom-authenticationextensionsprfoutputs-enabled">#dom-authenticationextensionsprfoutputs-enabled</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsprfoutputs-enabled">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-authenticationextensionsprfoutputs-enabled①">(2)</a> <a href="#ref-for-dom-authenticationextensionsprfoutputs-enabled②">(3)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="dom-authenticationextensionsprfoutputs-results">
+   <b><a href="#dom-authenticationextensionsprfoutputs-results">#dom-authenticationextensionsprfoutputs-results</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-dom-authenticationextensionsprfoutputs-results">10.1.4. Pseudo-random function extension (prf)</a> <a href="#ref-for-dom-authenticationextensionsprfoutputs-results①">(2)</a> <a href="#ref-for-dom-authenticationextensionsprfoutputs-results②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="largeblob">
    <b><a href="#largeblob">#largeblob</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-largeblob">10.5. Large blob storage extension (largeBlob)</a>
-    <li><a href="#ref-for-largeblob①">11.1.1. Authenticator Extension Capabilities</a>
-    <li><a href="#ref-for-largeblob②">11.5. Add Credential</a>
+    <li><a href="#ref-for-largeblob">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-largeblob①">(2)</a>
+    <li><a href="#ref-for-largeblob②">11.1.1. Authenticator Extension Capabilities</a>
+    <li><a href="#ref-for-largeblob③">11.5. Add Credential</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="enumdef-largeblobsupport">
    <b><a href="#enumdef-largeblobsupport">#enumdef-largeblobsupport</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-enumdef-largeblobsupport">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-enumdef-largeblobsupport">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-largeblobsupport-required">
    <b><a href="#dom-largeblobsupport-required">#dom-largeblobsupport-required</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-largeblobsupport-required">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-largeblobsupport-required">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-largeblobsupport-preferred">
    <b><a href="#dom-largeblobsupport-preferred">#dom-largeblobsupport-preferred</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-largeblobsupport-preferred">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dom-largeblobsupport-preferred">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-authenticationextensionslargeblobinputs">
    <b><a href="#dictdef-authenticationextensionslargeblobinputs">#dictdef-authenticationextensionslargeblobinputs</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-authenticationextensionslargeblobinputs">10.5. Large blob storage extension (largeBlob)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionslargeblobinputs">10.1.5. Large blob storage extension (largeBlob)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionslargeblobinputs-support">
    <b><a href="#dom-authenticationextensionslargeblobinputs-support">#dom-authenticationextensionslargeblobinputs-support</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionslargeblobinputs-support">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-support①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-support②">(3)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-support③">(4)</a>
+    <li><a href="#ref-for-dom-authenticationextensionslargeblobinputs-support">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-support①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-support②">(3)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-support③">(4)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionslargeblobinputs-read">
    <b><a href="#dom-authenticationextensionslargeblobinputs-read">#dom-authenticationextensionslargeblobinputs-read</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionslargeblobinputs-read">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read②">(3)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read③">(4)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read④">(5)</a>
+    <li><a href="#ref-for-dom-authenticationextensionslargeblobinputs-read">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read②">(3)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read③">(4)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-read④">(5)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionslargeblobinputs-write">
    <b><a href="#dom-authenticationextensionslargeblobinputs-write">#dom-authenticationextensionslargeblobinputs-write</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionslargeblobinputs-write">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write②">(3)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write③">(4)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write④">(5)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write⑤">(6)</a>
+    <li><a href="#ref-for-dom-authenticationextensionslargeblobinputs-write">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write②">(3)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write③">(4)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write④">(5)</a> <a href="#ref-for-dom-authenticationextensionslargeblobinputs-write⑤">(6)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionsclientoutputs-largeblob">
    <b><a href="#dom-authenticationextensionsclientoutputs-largeblob">#dom-authenticationextensionsclientoutputs-largeblob</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionsclientoutputs-largeblob">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionsclientoutputs-largeblob①">(2)</a>
+    <li><a href="#ref-for-dom-authenticationextensionsclientoutputs-largeblob">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionsclientoutputs-largeblob①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dictdef-authenticationextensionslargebloboutputs">
    <b><a href="#dictdef-authenticationextensionslargebloboutputs">#dictdef-authenticationextensionslargebloboutputs</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dictdef-authenticationextensionslargebloboutputs">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dictdef-authenticationextensionslargebloboutputs①">(2)</a>
+    <li><a href="#ref-for-dictdef-authenticationextensionslargebloboutputs">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dictdef-authenticationextensionslargebloboutputs①">(2)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionslargebloboutputs-supported">
    <b><a href="#dom-authenticationextensionslargebloboutputs-supported">#dom-authenticationextensionslargebloboutputs-supported</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionslargebloboutputs-supported">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-supported①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-supported②">(3)</a>
+    <li><a href="#ref-for-dom-authenticationextensionslargebloboutputs-supported">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-supported①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-supported②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionslargebloboutputs-blob">
    <b><a href="#dom-authenticationextensionslargebloboutputs-blob">#dom-authenticationextensionslargebloboutputs-blob</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionslargebloboutputs-blob">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-blob①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-blob②">(3)</a>
+    <li><a href="#ref-for-dom-authenticationextensionslargebloboutputs-blob">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-blob①">(2)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-blob②">(3)</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="dom-authenticationextensionslargebloboutputs-written">
    <b><a href="#dom-authenticationextensionslargebloboutputs-written">#dom-authenticationextensionslargebloboutputs-written</a></b><b>Referenced in:</b>
    <ul>
-    <li><a href="#ref-for-dom-authenticationextensionslargebloboutputs-written">10.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-written①">(2)</a>
+    <li><a href="#ref-for-dom-authenticationextensionslargebloboutputs-written">10.1.5. Large blob storage extension (largeBlob)</a> <a href="#ref-for-dom-authenticationextensionslargebloboutputs-written①">(2)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="user-verification-method">
+   <b><a href="#user-verification-method">#user-verification-method</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-user-verification-method">11.1.1. Authenticator Extension Capabilities</a>
+    <li><a href="#ref-for-user-verification-method①">11.2. Virtual Authenticators</a> <a href="#ref-for-user-verification-method②">(2)</a>
+    <li><a href="#ref-for-user-verification-method③">11.3. Add Virtual Authenticator</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="typedefdef-uvmentry">
+   <b><a href="#typedefdef-uvmentry">#typedefdef-uvmentry</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-typedefdef-uvmentry">10.2.1. User Verification Method Extension (uvm)</a>
+   </ul>
+  </aside>
+  <aside class="dfn-panel" data-for="typedefdef-uvmentries">
+   <b><a href="#typedefdef-uvmentries">#typedefdef-uvmentries</a></b><b>Referenced in:</b>
+   <ul>
+    <li><a href="#ref-for-typedefdef-uvmentries">10.2.1. User Verification Method Extension (uvm)</a>
+    <li><a href="#ref-for-typedefdef-uvmentries①">11.2. Virtual Authenticators</a>
+    <li><a href="#ref-for-typedefdef-uvmentries②">11.3. Add Virtual Authenticator</a>
    </ul>
   </aside>
   <aside class="dfn-panel" data-for="authenticator-extension-capabilities">