Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Editorial changes from PR #718 #752

Merged
merged 4 commits into from
Feb 6, 2018
Merged

Editorial changes from PR #718 #752

Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
e192c3e
Un-hardcode step numbers in RP operations
emlun Dec 7, 2017
301aa02
Introduce |response| variable in RP registration operation
emlun Dec 7, 2017
780a818
Address most of @equalsJeffH's review comments
emlun Dec 20, 2017
8233396
Merge branch 'master' into pr-718-editorial-changes
emlun Feb 5, 2018
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 22 additions & 23 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2741,28 +2741,27 @@ structures.

## Registering a new credential ## {#registering-a-new-credential}

When registering a new credential, represented by a {{AuthenticatorAttestationResponse}} structure, as part of a
When registering a new credential, represented by a {{AuthenticatorAttestationResponse}} structure |response|, as part of a
[=registration=] [=ceremony=], a [=[RP]=] MUST proceed as follows:

1. Perform JSON deserialization on the {{AuthenticatorResponse/clientDataJSON}} field of the
{{AuthenticatorAttestationResponse}} object to extract the [=client data=] |C| claimed as collected during the credential
creation.
1. Perform JSON deserialization on <code>|response|.{{AuthenticatorResponse/clientDataJSON}}</code> to extract the [=client data=]
|C| claimed as collected during the credential creation.

1. Verify that the {{CollectedClientData/type}} in |C| is the string `webauthn.create`.
1. Verify that the value of <code>|C|.{{CollectedClientData/type}}</code> is `webauthn.create`.

1. Verify that the {{CollectedClientData/challenge}} in |C| matches the challenge that was sent to the authenticator in the
{{CredentialsContainer/create()}} call.
1. Verify that the value of <code>|C|.{{CollectedClientData/challenge}}</code> matches the challenge that was sent to the
authenticator in the {{CredentialsContainer/create()}} call.

1. Verify that the {{CollectedClientData/origin}} in |C| matches the [=[RP]=]'s [=origin=].
1. Verify that the value of <code>|C|.{{CollectedClientData/origin}}</code> matches the [=[RP]=]'s [=origin=].

1. Verify that the {{CollectedClientData/tokenBindingId}} in |C| matches the [=Token Binding ID=] for the TLS connection over
which the attestation was obtained.
1. Verify that the value of <code>|C|.{{CollectedClientData/tokenBindingId}}</code> matches the [=Token Binding ID=] for the TLS
connection over which the attestation was obtained.

1. Verify that the {{CollectedClientData/clientExtensions}} in |C| is a subset of the extensions requested by the RP
and that the {{CollectedClientData/authenticatorExtensions}} in |C| is also a subset of the extensions requested by
the RP.
1. Verify that the value of <code>|C|.{{CollectedClientData/clientExtensions}}</code> is a subset of the extensions requested by
the RP and that the value of <code>|C|.{{CollectedClientData/authenticatorExtensions}}</code> is also a subset of the
extensions requested by the RP.

1. Compute the hash of {{AuthenticatorResponse/clientDataJSON}} using SHA-256.
1. Compute the hash of <code>|response|.{{AuthenticatorResponse/clientDataJSON}}</code> using SHA-256.

1. Perform CBOR decoding on the {{AuthenticatorAttestationResponse/attestationObject}} field of the
{{AuthenticatorAttestationResponse}} structure to obtain the attestation statement format |fmt|, the [=authenticator data=]
Expand Down Expand Up @@ -2841,19 +2840,19 @@ When verifying a given {{PublicKeyCredential}} structure (|credential|) as part

1. Perform JSON deserialization on |cData| to extract the [=client data=] |C| used for the signature.

1. Verify that the {{CollectedClientData/type}} in |C| is the string `webauthn.get`.
1. Verify that the value of <code>|C|.{{CollectedClientData/type}}</code> is the string `webauthn.get`.

1. Verify that the {{CollectedClientData/challenge}} member of |C| matches the challenge that was sent to the authenticator in
the {{PublicKeyCredentialRequestOptions}} passed to the {{CredentialsContainer/get()}} call.
1. Verify that the value of <code>|C|.{{CollectedClientData/challenge}}</code> matches the challenge that was sent to the
authenticator in the {{PublicKeyCredentialRequestOptions}} passed to the {{CredentialsContainer/get()}} call.

1. Verify that the {{CollectedClientData/origin}} member of |C| matches the [=[RP]=]'s [=origin=].
1. Verify that the value of <code>|C|.{{CollectedClientData/origin}}</code> matches the [=[RP]=]'s [=origin=].

1. Verify that the {{CollectedClientData/tokenBindingId}} member of |C| (if present) matches the [=Token Binding ID=] for the
TLS connection over which the signature was obtained.
1. Verify that the value of <code>|C|.{{CollectedClientData/tokenBindingId}}</code> (if present) matches the [=Token Binding ID=]
for the TLS connection over which the signature was obtained.

1. Verify that the {{CollectedClientData/clientExtensions}} member of |C| is a subset of the extensions requested by the
[=[RP]=] and that the {{CollectedClientData/authenticatorExtensions}} in |C| is also a subset of the extensions
requested by the [=[RP]=].
1. Verify that the value of <code>|C|.{{CollectedClientData/clientExtensions}}</code> is a subset of the extensions requested by
the [=[RP]=] and that the value of <code>|C|.{{CollectedClientData/authenticatorExtensions}}</code> is also a subset of the
extensions requested by the [=[RP]=].

1. Verify that the <code>[=rpIdHash=]</code> in |aData| is the SHA-256 hash of the [=RP ID=] expected by the [=[RP]=].

Expand Down