W3C home > Mailing lists > Public > public-webauthn@w3.org > March 2018

[webauthn] Pull Request: WIP: Authenticator taxonomy

From: Emil Lundberg via GitHub <sysbot+gh@w3.org>
Date: Thu, 15 Mar 2018 17:02:21 +0000
To: public-webauthn@w3.org
Message-ID: <pull_request.opened-175317240-1521133340-sysbot+gh@w3.org>
emlun has just submitted a new pull request for https://github.com/w3c/webauthn:

== WIP: Authenticator taxonomy ==
_This is a work in progress._

This aims to resolve #422.

This is what I've come up with so far. It will likely need some rather major surgery before it's ready to be merged, so I'd be happy for both detail-level corrections and high-level restructuring suggestions. Other editors are welcome to push commits directly into this PR, too.

Some issues I've identified while writing this:

- I think we've implicitly assumed throughout the spec that authenticators will always require user verification to create and use client-side-resident credential private keys, but this doesn't seem to be documented in the spec. CTAP2 also doesn't seem to specify this behaviour. The "username-less use case" I've written in here is probably not very useful and would be merged into the "single-step use case" given the above requirement, but without that requirement it remains a possible scenario.
  - [ ] Resolution:
- Is there someplace we can refer to for "authentication factor" and the related terms (known/possessed/biometric factor) instead of defining them in the spec? The Internet Security Glossary (RFC 4949) doesn't seem to have them.
  - [ ] Resolution:
- This text might not belong in the Authenticator Model section.
  - [ ] Resolution:

See https://github.com/w3c/webauthn/pull/842
Received on Thursday, 15 March 2018 17:02:26 UTC

This archive was generated by hypermail 2.4.0 : Tuesday, 5 July 2022 07:26:31 UTC