Re: [webauthn] Generalize PRF extension processing to non-CTAP authenticators (#2298)

I've now reworked the extension processing steps to clearly distinguish between CTAP and non-CTAP implementations, the latter being abstractly defined. @nsatragno @zacknewman thoughts?

I changed my mind about `hmac-secret-mc`; adding that would definitely be a technical change that we need to demonstrate 2 interoperable implementations of, which is (probably?) infeasible for L3. I think it's fine for `hmac-secret-mc` to slip to L4, since the current specification already vaguely references such a "future extension" that may be used.

I guess this raises the question of whether we also need to show interoperable implementations of the abstract non-CTAP specification. But maybe those already exist? @pascoej @nicksteele do you know?

-- 
GitHub Notification of comment by emlun
Please view or discuss this issue at https://github.com/w3c/webauthn/pull/2298#issuecomment-2962698400 using your GitHub account


-- 
Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config

Received on Wednesday, 11 June 2025 13:23:17 UTC