"priority:implementation" issues, and PRs left for WD-05
04/05/2017 W3C Web Authentication WG Meeting Agenda
04/12/2017 W3C Web Authentication WG Meeting Agenda
04/14/2017 W3C Web Authentication WG Agenda
04/19/2017 W3C Web Authentication WG Meeting Agenda
04/26/2017 W3C Web Authentication WG Meeting Agenda
[w3c/webauthn]
[w3c/webauthn] 0154cb: replaced DAA root key by daaKeyId. Added proper r...
[w3c/webauthn] 09c1ea: Built by Travis-CI: 333b8aad131f7f0d437e304eecfa12...
[w3c/webauthn] 1fd6ae: repair fig 3 - fix #401
[w3c/webauthn] 22913b: first draft of uaf attestation statement format
[w3c/webauthn] 2c7ba2: Built by Travis-CI: 5dedfde4c1e8ea8dff382fbf958479...
[w3c/webauthn] 2cccb3: Built by Travis-CI: 66c6224cbb287bd6cc4236c2e004dd...
[w3c/webauthn] 2d10a1: Introduce authenticator response interfaces.
[w3c/webauthn] 3311f8: corrected image (DAA--> ECDAA etc.)
[w3c/webauthn] 333b8a: Fix issue #418 - What extension data is in Authent...
[w3c/webauthn] 34e083: Correct omissions that failed to send authenticato...
[w3c/webauthn] 371886: Built by Travis-CI: 8eb7b5c7323312a2f49bab4aec04c0...
[w3c/webauthn] 37e612: Remove one line
[w3c/webauthn] 3b5138: Tiny typo in 'ScopedCredentialDesciptor'.
[w3c/webauthn] 4fad3e: Convert `makeCredential()`'s parameters into a dic...
[w3c/webauthn] 5535f4: incorp jyasskin suggestion. improves #387
[w3c/webauthn] 565096: corrected signing and verification procedure for U...
[w3c/webauthn] 5a0a88: Built by Travis-CI: c22e2ab8350c8ed2b94b9d158e2c0e...
[w3c/webauthn] 669221: Add a link to web-platform-tests to the top of the...
[w3c/webauthn] 6d873d: Add displayName for the user account (#423)
[w3c/webauthn] 6f2f11: Renamed timeoutSeconds to timeoutMilliseconds as s...
[w3c/webauthn] 76a716: address empty allowlist in 'use existing cred' alg...
[w3c/webauthn] 883c6f: Built by Travis-CI: 6d873d597fae3a595039bdfb070e29...
[w3c/webauthn] 8eb7b5: Separated proposed changes to extension semantics ...
[w3c/webauthn] 91fe1a: Merged master
[w3c/webauthn] 93448b: Built by Travis-CI: 55cd330c436202a92c575d4b28db11...
[w3c/webauthn] a1e74d: Update according to comment
[w3c/webauthn] a3bae0: Updated PR based on Jeffrey comment
[w3c/webauthn] a9da99: Move `getAssertion()`'s `challenge` into `Assertio...
[w3c/webauthn] ad8e59: Built by Travis-CI: b4009d4dbc3fa47aa588b11915af23...
[w3c/webauthn] b1bd6c: first draft of new credential type ScopedCred_FIDO...
[w3c/webauthn] c21268: more surgery hopefully improving #387
[w3c/webauthn] d2ea8e: Merge PR 384 and remove RK bit
[w3c/webauthn] e1ffe6: surgery w/hammer, saw, torch on prior attempt to i...
[w3c/webauthn] e5f424: Remove unnecessary blank
[w3c/webauthn] e6608d: Built by Travis-CI: 275a5522be02b102a895964ee99692...
[w3c/webauthn] f84ba9: Built by Travis-CI: f99d7181e7f56d371bcb506f48295b...
[w3c/webauthn] f99d71: Throw NotFoundError when no authenticator is avail...
[w3c/webauthn] fba8ac: Remove unnecessary whitespace
[webauthn] "authentication" attribute on Navigator should be [SecureContext]
[webauthn] "Authenticator argument" vs. "authenticator data value" in Extensions section
[webauthn] "credential ID" not signed over by authenticatorGetAssertion operation
[webauthn] "NotAllowedError" is in WebIDL editors draft but not in WebIDL Level 1
[webauthn] "rp" isn't a widely enough known acronym?, should be relyingParty instead?
[webauthn] "ScopedCred" enum should be "scoped-cred"
[webauthn] 3rd approach: Add authenticator selection dictionary to create with attachment
[webauthn] [PR 384] Does requireUserMediation() make sense after merge
[webauthn] _rpId_ generation allows more relaxation of same-origin restrictions than document.domain does
[webauthn] Account information merge
- =JeffH via GitHub (Friday, 28 April)
- Mike Jones via GitHub (Tuesday, 25 April)
- Mike Jones via GitHub (Monday, 24 April)
- Alexei Czeskis via GitHub (Monday, 24 April)
- =JeffH via GitHub (Monday, 24 April)
- Mike West via GitHub (Monday, 24 April)
- Mike Jones via GitHub (Monday, 24 April)
- =JeffH via GitHub (Monday, 24 April)
- Mike West via GitHub (Monday, 24 April)
- =JeffH via GitHub (Saturday, 22 April)
- Alexei Czeskis via GitHub (Thursday, 20 April)
- Angelo Liao via GitHub (Thursday, 20 April)
- Alexei Czeskis via GitHub (Thursday, 20 April)
[webauthn] Add "willMakeCredentialWorkWithTheseConstraints()" method to the API
[webauthn] Add a link to web-platform-tests to the top of the spec
[webauthn] Add cloud transport option to transport hint
[webauthn] Add explanation of why the account argument is useful
[webauthn] Add gesture verification parameter to option in both makeC and getA
[webauthn] Add getAuthenticatorInfo to the Authenticator Model section
[webauthn] Add isPlatformAuthenticatorReady function to the API surface
[webauthn] Add Test of User Identity (TUI) bit to authenticator data
- Angelo Liao via GitHub (Thursday, 20 April)
- Jeffrey Yasskin via GitHub (Thursday, 20 April)
- =JeffH via GitHub (Thursday, 20 April)
- =JeffH via GitHub (Thursday, 20 April)
- Angelo Liao (Thursday, 20 April)
- Jakob Ehrensvärd (Thursday, 20 April)
- Jeffrey Yasskin via GitHub (Thursday, 20 April)
- Angelo Liao via GitHub (Wednesday, 19 April)
- =JeffH via GitHub (Wednesday, 19 April)
- Alexei Czeskis via GitHub (Wednesday, 19 April)
[webauthn] Add User Verification (UV) bit to authenticator data
[webauthn] address empty allowlist in 'use existing cred' alg, fixes #387
[webauthn] adopt definition list markdown notation for <div dfn-type="foo" dfn-for="bar"> blocks
[webauthn] AssertionOptions and ScopedCredentialOptions could both inherit from a dictionary which has their shared members
[webauthn] attachment is only explicitly used in create()
[webauthn] attObj and Figure 3 [[#fig-attStructs]] do not agree
[webauthn] authenticator taxonomy
[webauthn] authenticatorCancel seems like it can cancel too much
[webauthn] Clarify how a user can authenticate from multiple devices
[webauthn] clarify normality of authenticator model - is it actually authenticator API ?
[webauthn] Clarify what is a proprietary attestation format and whether it should be designated by a prefix
[webauthn] cleanup: attestation object `attObj` format not clearly delineated
[webauthn] Client arguments should be specified with "partial dictionary AuthenticationExtensions"
[webauthn] Consider empty allowLists
[webauthn] Consider using USVString instead of DOMString sometimes
[webauthn] Convert `makeCredential()`'s parameters into a dictionary.
[webauthn] Correct uses of "JSON string" versus "DOMString" and other string terminology usage
[webauthn] Credential CBOR
[webauthn] daaKey format? (ECPointToB -> ECPoint2ToB)
[webauthn] Define extension client processing more carefully.
[webauthn] Define what happens when the Document loses focus
[webauthn] define what to do if both normalizedAlgorithm and cryptoParameters are empty
[webauthn] detail-level issues in signature format, attestation format(s), attestation statement
[webauthn] do not totally lose the term "WebAuthn Relying Party"
[webauthn] DOMString[] should be FrozenArray<DOMString>
[webauthn] Drop UAF references in favor of better explanation
[webauthn] Eliminate duplicate terminology
[webauthn] Enable RP to choose authenticators based on key storage capability
[webauthn] excludeList and allowList should be excludeCredentials and allowCredentials
[webauthn] explain challenge's security importance and use in both registration and authentication operations
- =JeffH via GitHub (Wednesday, 19 April)
- Mike West via GitHub (Wednesday, 19 April)
- Vijay Bharadwaj via GitHub (Wednesday, 19 April)
- Mike West via GitHub (Tuesday, 18 April)
- Angelo Liao via GitHub (Tuesday, 18 April)
- =JeffH via GitHub (Tuesday, 18 April)
- Mike West via GitHub (Saturday, 15 April)
- =JeffH via GitHub (Friday, 14 April)
- Jeffrey Yasskin via GitHub (Friday, 14 April)
- =JeffH via GitHub (Friday, 14 April)
- Jeffrey Yasskin via GitHub (Friday, 14 April)
- =JeffH via GitHub (Friday, 14 April)
[webauthn] Expose standard authenticator fields in JS objects, vs. binary
[webauthn] Fetch intergration for WebAuthn API
[webauthn] Filter makeCredential() by acceptable trust anchors
[webauthn] follow Bluetooth and NFC brand usage guidance
[webauthn] hashAlg -> hashAlgorithm?
[webauthn] How to unmarshal in TPM Structure.
[webauthn] Internationalization self review
[webauthn] Introduce authenticator response interfaces.
[webauthn] Is _rpId_ supposed to look like an origin serialization, or like a hostname?
[webauthn] leverage "credential source" term from credential management spec
[webauthn] makeCredential should be more precise than NotAllowedError in its last step
[webauthn] Move `getAssertion()`'s `challenge` into `AssertionOptions`
[webauthn] new commits pushed by AngeloKai
- Angelo Liao via GitHub (Tuesday, 25 April)
- Angelo Liao via GitHub (Tuesday, 25 April)
- Angelo Liao via GitHub (Monday, 24 April)
- Angelo Liao via GitHub (Monday, 24 April)
- Angelo Liao via GitHub (Monday, 24 April)
- Angelo Liao via GitHub (Friday, 21 April)
- Angelo Liao via GitHub (Wednesday, 19 April)
- Angelo Liao via GitHub (Wednesday, 19 April)
- Angelo Liao via GitHub (Wednesday, 19 April)
- Angelo Liao via GitHub (Wednesday, 19 April)
[webauthn] new commits pushed by equalsJeffH
- =JeffH via GitHub (Saturday, 29 April)
- =JeffH via GitHub (Friday, 28 April)
- =JeffH via GitHub (Friday, 28 April)
- =JeffH via GitHub (Wednesday, 26 April)
- =JeffH via GitHub (Wednesday, 26 April)
- =JeffH via GitHub (Wednesday, 26 April)
- =JeffH via GitHub (Tuesday, 25 April)
- =JeffH via GitHub (Sunday, 23 April)
- =JeffH via GitHub (Friday, 21 April)
- =JeffH via GitHub (Friday, 21 April)
- =JeffH via GitHub (Wednesday, 19 April)
- =JeffH via GitHub (Friday, 14 April)
- =JeffH via GitHub (Friday, 14 April)
- =JeffH via GitHub (Friday, 14 April)
[webauthn] new commits pushed by rlin1
[webauthn] new commits pushed by selfissued
[webauthn] new commits pushed by vijaybh
[webauthn] new commits pushed by WebAuthnBot
- WebAuthnBot via GitHub (Saturday, 29 April)
- WebAuthnBot via GitHub (Saturday, 29 April)
- WebAuthnBot via GitHub (Friday, 28 April)
- WebAuthnBot via GitHub (Thursday, 27 April)
- WebAuthnBot via GitHub (Monday, 24 April)
- WebAuthnBot via GitHub (Sunday, 23 April)
- WebAuthnBot via GitHub (Friday, 21 April)
- WebAuthnBot via GitHub (Wednesday, 19 April)
- WebAuthnBot via GitHub (Friday, 14 April)
- WebAuthnBot via GitHub (Friday, 14 April)
[webauthn] normalize RFC2119 language
[webauthn] normalizing term(s) for authenticator-generated RP-specific public key
[webauthn] Processing model for extensions is very underdefined
[webauthn] Protect against TLS MiTM by including TLS cert chain in signature
[webauthn] RawId vs Id is confusing
[webauthn] References to "algorithm" and "alg" should be same string
[webauthn] refine extension terminology
[webauthn] rename "attestation data" to be "attested credential"
[webauthn] Rename ScopedCredential to PublicKeyCredential
[webauthn] Replace Authenticator Model with CTAP
[webauthn] restrict WebAuthentication API to only top level browsing context
[webauthn] rpID seems to have changed meaning a bit
[webauthn] Send authenticator extension inputs to authenticators and send client extension outputs to RPs
[webauthn] Separated proposed changes to extension semantics from PR #386 and use TypeError, per @jyasskin
[webauthn] Setting _rpId_ to _callerOrigin_ doesn't make sense
[webauthn] Should the "authentication" attribute on Navigator be [SameObject]?
[webauthn] Should the WebAuth API have a cancel() method?
[webauthn] Some editing cleanup following cred man merge
[webauthn] some RPs may wish to allow multiple registrations to same user account
[webauthn] Spec should not mandate behavior of server
[webauthn] Specify the set of hash algorithms UAs can select between.
[webauthn] Strawman of an integration between WebAuthn and Credential Management.
- =JeffH via GitHub (Wednesday, 19 April)
- Mike West via GitHub (Wednesday, 19 April)
- =JeffH via GitHub (Wednesday, 19 April)
- Mike West via GitHub (Wednesday, 19 April)
- =JeffH via GitHub (Tuesday, 18 April)
- Angelo Liao via GitHub (Tuesday, 18 April)
- =JeffH via GitHub (Monday, 10 April)
- Mike West via GitHub (Monday, 10 April)
- =JeffH via GitHub (Saturday, 8 April)
- balfanz via GitHub (Friday, 7 April)
- =JeffH via GitHub (Wednesday, 5 April)
- Mike Jones via GitHub (Wednesday, 5 April)
- =JeffH via GitHub (Wednesday, 5 April)
- =JeffH via GitHub (Wednesday, 5 April)
- Mike Jones via GitHub (Wednesday, 5 April)
[webauthn] TAG review feedback: Align Credential interface with Credential Management?
[webauthn] Throw "NotFoundError" when internal authenticator is not available or not found
[webauthn] Throw NotFoundError when no authenticator is available
- =JeffH via GitHub (Saturday, 29 April)
- Mike Jones via GitHub (Saturday, 29 April)
- =JeffH via GitHub (Saturday, 29 April)
- Vijay Bharadwaj via GitHub (Wednesday, 26 April)
- =JeffH via GitHub (Wednesday, 26 April)
- Alexei Czeskis via GitHub (Wednesday, 26 April)
- Vijay Bharadwaj via GitHub (Wednesday, 26 April)
- =JeffH via GitHub (Sunday, 23 April)
- =JeffH via GitHub (Sunday, 23 April)
- =JeffH via GitHub (Sunday, 23 April)
- Mike Jones via GitHub (Sunday, 23 April)
- Mike Jones via GitHub (Wednesday, 5 April)
[webauthn] tokenBinding member of ClientData should be tokenBindingID
[webauthn] Too generic names?
[webauthn] Track rename issues to maintain consistency
[webauthn] U2F Attestation only lists Basic Attestation as supported
[webauthn] Update attestation format identifiers in registry to match spec
[webauthn] update extensions framework to include interfacing with user agent permissions framework
[webauthn] UVM Extension Editorial Change
[webauthn] UVM should be "method" rather than "mode" ?
[webauthn] Various attributes of ScopedCredentialInfo should probably be [SameObject]
[webauthn] web-api: is further language needed describing AppID (aka rpId) usage ?
[webauthn] What does store() do?
[webauthn] What ensures any semblance of interop for WebAuthnExtensions?
[webauthn] What extension data is in AuthenticatorAssertionResponse.authenticatorData?
[webauthn] Why are various predefined extensions defined as extensions, and not just parts of the spec?
[webauthn] Why is the only value of ScopedCredentialType "ScopedCred" as opposed to "ScopedCredential"?
[webauthn] Why was PR #409 (UV bit) merged?
Benefits of exposing webauthn through navigator.credentials
Closed: [webauthn] "Authenticator argument" vs. "authenticator data value" in Extensions section
Closed: [webauthn] "rp" isn't a widely enough known acronym?, should be relyingParty instead?
Closed: [webauthn] Account information merge
Closed: [webauthn] Add cloud transport option to transport hint
Closed: [webauthn] Add explanation of why the account argument is useful
Closed: [webauthn] Clarify what is a proprietary attestation format and whether it should be designated by a prefix
Closed: [webauthn] Client arguments should be specified with "partial dictionary AuthenticationExtensions"
Closed: [webauthn] Define extension client processing more carefully.
Closed: [webauthn] DOMString[] should be FrozenArray<DOMString>
Closed: [webauthn] How to unmarshal in TPM Structure.
Closed: [webauthn] Processing model for extensions is very underdefined
Closed: [webauthn] refine extension terminology
Closed: [webauthn] Should the "authentication" attribute on Navigator be [SameObject]?
Closed: [webauthn] TAG review feedback: Align Credential interface with Credential Management?
Closed: [webauthn] Throw "NotFoundError" when internal authenticator is not available or not found
Closed: [webauthn] Update attestation format identifiers in registry to match spec
Closed: [webauthn] UVM should be "method" rather than "mode" ?
Closed: [webauthn] What ensures any semblance of interop for WebAuthnExtensions?
Closed: [webauthn] Why are various predefined extensions defined as extensions, and not just parts of the spec?
correction to webauthn F2F Feb-2017 minutes
Dirk's presentation of the relationship between CredMan and WebAuthn
Extension language significantly clarified
headzup: issues with travis-ci's bikeshed output?
Intended Status for <draft-hodges-webauthn-registries-00.txt> changed to Informational
merge #397, #398, #399 ?
Minutes of past meetings
PR #217 factored into 8 PRs, each with defined purpose and scope
PR #384 CredMan Integration
- Hodges, Jeff (Wednesday, 12 April)
- Alexei Czeskis (Wednesday, 12 April)
- Vijay Bharadwaj (Tuesday, 11 April)
- Mike West (Tuesday, 11 April)
- Hodges, Jeff (Tuesday, 11 April)
- Angelo Liao (Tuesday, 11 April)
- Hodges, Jeff (Tuesday, 11 April)
- Angelo Liao (Tuesday, 11 April)
- Alexei Czeskis (Tuesday, 11 April)
- J.C. Jones (Tuesday, 11 April)
- Angelo Liao (Tuesday, 11 April)
- Angelo Liao (Tuesday, 11 April)
- Hodges, Jeff (Tuesday, 11 April)
- Vijay Bharadwaj (Tuesday, 11 April)
- Alexei Czeskis (Tuesday, 11 April)
- Anthony Nadalin (Tuesday, 11 April)
- Hodges, Jeff (Monday, 10 April)
- Anthony Nadalin (Monday, 10 April)
PRs left for WD-05
Review of PR #378 "Enable RP to choose authenticators based on key storage capability"
review of PR #384 submitted
Review of PR #409: Add User Verification (UV) bit to authenticator data
Review of PR#350: Throw NotFoundError when no authenticator is available
Review PR 378, 428, 429
Review PR 378:
Splitting "Credential Management"?
Unknowns of the WebAuthn + CredMan merge
wrt PR #397 and #398
Last message date: Sunday, 30 April 2017 00:01:47 UTC