- From: philomathic_life via GitHub <noreply@w3.org>
- Date: Fri, 30 May 2025 18:49:13 +0000
- To: public-webauthn@w3.org
I still feel it reads as too `hmac-secret`-centric. `prf` is technically a separate extension, and coupling it with `hmac-secret`/`hmac-secret-mc` is the exception. Additionally, there are parts that are still not true. For example: > **Authenticator extension input / processing / output** > > [This extension](https://pr-preview.s3.amazonaws.com/w3c/webauthn/pull/2298.html#prf) uses the [[FIDO-CTAP]](https://pr-preview.s3.amazonaws.com/w3c/webauthn/pull/2298.html#biblio-fido-ctap) `hmac-secret` extension when communicating with the authenticator. It thus does not specify any direct authenticator interaction for [Relying Parties](https://pr-preview.s3.amazonaws.com/w3c/webauthn/pull/2298.html#relying-party). That's not true for non-CTAP authenticators. More specifically, I think `hmac-secret` should be removed entirely from the `prf` section with the following exceptions: In the processing and output sections, there should be two subsections: one for CTAP authenticators talking about how to process and output `prf` via `hmac-secret` and `hmac-secret-mc` and one for non-CTAP authenticators which talks about a much more general way of processing `prf` making sure to address @nsatragno's [question](https://github.com/w3c/webauthn/pull/2298#discussion_r2116193319). Additionally in the `prf` example section, the CTAP `hmac-secret` subsection should be augmented to include `hmac-secret-mc` showing that during registration the authenticator data will have at least two extensions: first `hmac-secret` with a value of `true` and another `hmac-secret-mc` with a value that is a byte string of length 48 or 80 containing the encrypted contents of `prf.results` for one and two inputs respectively. The above will make it more obvious that `prf` is typically unrelated to `hmac-secret`/`hmac-secret-mc` while still mentioning those extensions more appropriately in their own separate subsections. This will also address the now out-of-date client processing step: > If [`eval`](https://pr-preview.s3.amazonaws.com/w3c/webauthn/pull/2298.html#dom-authenticationextensionsprfinputs-eval) is present and a future extension to [[FIDO-CTAP]](https://pr-preview.s3.amazonaws.com/w3c/webauthn/pull/2298.html#biblio-fido-ctap) permits evaluation of the PRF at creation time, configure `hmac-secret` inputs accordingly: by explicitly mentioning the now-defined `hmac-secret-mc` extension. -- GitHub Notification of comment by zacknewman Please view or discuss this issue at https://github.com/w3c/webauthn/pull/2298#issuecomment-2923170850 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Friday, 30 May 2025 18:49:13 UTC