- From: Matthew Miller via GitHub <noreply@w3.org>
- Date: Tue, 02 Jun 2026 08:07:56 +0000
- To: public-webauthn@w3.org
> ### Proposed Change 1: Overwrite the existing credential if RPID, UserID and Algorithm are the same. > * Addition of algorithm in overwrite logic will allow two different algorithms to exist for the same RP in same authenticator. > * UserID can remain the same for the those different algorithms credentials and platform can do heuristics to show only one of the credentials based on RP's algorithm preference I've been pondering this proposed change. My gut is telling me that a **credential ID, of an existing credential** using a classical algorithm that is the reason the RP wants to rotate the passkey for a PQC keypair, should also be required here. Including the credential ID in the ceremoney would help facilitate the creation of a new PQC keypair, mapped to the same RP ID and user ID, **on the same authenticator** that owns the "old" passkey. Otherwise the user could use a second authenticator and end up needing to remember which authenticator has the PQC passkey. `PublicKeyCredentialCreationOptions` could gain something like an "`allowCredential`" option to specify such a credential ID 🤔 -- GitHub Notification of comment by MasterKale Please view or discuss this issue at https://github.com/w3c/webauthn/issues/2417#issuecomment-4600058775 using your GitHub account -- Sent via github-notify-ml as configured in https://github.com/w3c/github-notify-ml-config
Received on Tuesday, 2 June 2026 08:07:58 UTC