Internet Assigned Numbers Authority • Domains • Protocols • Numbers • About Web Authentication (WebAuthn) Created 2020-06-11 Last Updated 2023-09-13 Available Formats [IMG] XML [IMG] HTML [IMG] TXT Registries Included Below • WebAuthn Attestation Statement Format Identifiers • WebAuthn Extension Identifiers WebAuthn Attestation Statement Format Identifiers Registration Procedure(s) Specification Required Expert(s) Mike Jones, Giridhar Mandyam Reference [RFC 8809] Available Formats [IMG] CSV WebAuthn Attestation Description Reference Change Controller Notes Statement Format Identifier The "packed" attestation statement format is a WebAuthn-optimized format for attestation. It [Web Authentication] Section packed uses a very compact but still extensible §8.2, Packed Attestation [W3C_Web_Authentication_Working_Group] encoding method. This format is implementable by Statement Format authenticators with limited resources (e.g., secure elements). The TPM attestation statement format returns an attestation statement in the same format as the [Web Authentication] Section tpm packed attestation statement format, although §8.3, TPM Attestation [W3C_Web_Authentication_Working_Group] the rawData and signature fields are computed Statement Format differently. Platform authenticators on versions "N", and [Web Authentication] Section android-key later, may provide this proprietary "hardware §8.4, Android Key [W3C_Web_Authentication_Working_Group] attestation" statement. Attestation Statement Format Android-based platform authenticators MAY [Web Authentication] Section android-safetynet produce an attestation statement based on the §8.5, Android SafetyNet [W3C_Web_Authentication_Working_Group] Android SafetyNet API. Attestation Statement Format [Web Authentication] Section fido-u2f Used with FIDO U2F authenticators §8.6, FIDO U2F Attestation [W3C_Web_Authentication_Working_Group] Statement Format [Web Authentication] Section apple Used with Apple devices' platform authenticators §8.8, Apple Anonymous [W3C_Web_Authentication_Working_Group] Attestation Statement Format Used to replace any authenticator-provided [Web Authentication] Section none attestation statement when a WebAuthn Relying §8.7, None Attestation [W3C_Web_Authentication_Working_Group] Party indicates it does not wish to receive Statement Format attestation information. WebAuthn Extension Identifiers Registration Procedure(s) Specification Required Expert(s) Mike Jones, Giridhar Mandyam Reference [RFC 8809] Available Formats [IMG] CSV WebAuthn Extension Description Reference Change Controller Notes Identifier This authentication extension allows WebAuthn Relying [Web Authentication] appid Parties that have previously registered a credential using Section §10.1, FIDO AppID [W3C_Web_Authentication_Working_Group] the legacy FIDO JavaScript APIs to request an assertion. Extension (appid) This registration extension and authentication extension [Web Authentication] txAuthSimple allows for a simple form of transaction authorization. A Section §10.2, Simple [W3C_Web_Authentication_Working_Group] WebAuthn Relying Party can specify a prompt string, intended Transaction Authorization for display on a trusted device on the authenticator Extension (txAuthSimple) This registration extension and authentication extension allows images to be used as transaction authorization [Web Authentication] txAuthGeneric prompts as well. This allows authenticators without a font Section §10.3, Generic [W3C_Web_Authentication_Working_Group] rendering engine to be used and also supports a richer Transaction Authorization visual appearance than accomplished with the Extension (txAuthGeneric) webauthn.txauth.simple extension. This registration extension allows a WebAuthn Relying Party [Web Authentication] to guide the selection of the authenticator that will be Section §10.4, authnSel leveraged when creating the credential. It is intended Authenticator Selection [W3C_Web_Authentication_Working_Group] primarily for WebAuthn Relying Parties that wish to tightly Extension (authnSel) control the experience around credential creation. This registration extension enables the WebAuthn Relying Party to determine which extensions the authenticator [Web Authentication] exts supports. The extension data is a list (CBOR array) of Section §10.5, Supported [W3C_Web_Authentication_Working_Group] extension identifiers encoded as UTF-8 Strings. This Extensions Extension extension is added automatically by the authenticator. This (exts) extension can be added to attestation statements. This registration extension and authentication extension enables use of a user verification index. The user verification index is a value uniquely identifying a user [Web Authentication] uvi verification data record. The UVI data can be used by Section §10.6, User [W3C_Web_Authentication_Working_Group] servers to understand whether an authentication was Verification Index authorized by the exact same biometric data as the initial Extension (uvi) key generation. This allows the detection and prevention of "friendly fraud". The location registration extension and authentication [Web Authentication] loc extension provides the client device's current location to Section §10.7, Location [W3C_Web_Authentication_Working_Group] the WebAuthn Relying Party, if supported by the client Extension (loc) platform and subject to user consent. This registration extension and authentication extension [Web Authentication] enables use of a user verification method. The user Section §10.3, User uvm verification method extension returns to the WebAuthn Verification Method [W3C_Web_Authentication_Working_Group] Relying Party which user verification methods (factors) were Extension (uvm) used for the WebAuthn operation. This registration extension allows relying parties to specify a credential protection policy when creating a [Client to Authenticator credProtect credential. Additionally, authenticators may choose to Protocol (CTAP)] Section [W3C_Web_Authentication_Working_Group] establish a default credential protection policy greater §12.1 Credential than userVerificationOptional (the lowest level) and Protection (credProtect) unilaterally enforce such policy. This registration extension and authentication extension [Client to Authenticator credBlob enables RPs to provide a small amount of extra credential Protocol (CTAP)] Section [W3C_Web_Authentication_Working_Group] configuration information (the credBlob value) to the §12.2 Credential Blob authenticator when a credential is made. (credBlob) This client platform-only extension provides for storage and [Client to Authenticator largeBlobKey retrieval of a per-credential key that is used by the client Protocol (CTAP)] Section [W3C_Web_Authentication_Working_Group] platform when writing and reading elements in the large-blob §12.3 Large Blob Key array. (largeBlobKey) [Client to Authenticator minPinLength This registration extension returns the current minimum PIN Protocol (CTAP)] Section [W3C_Web_Authentication_Working_Group] length value to the Relying Party. §12.4 Minimum PIN Length Extension (minPinLength) This registration extension and authentication extension [Client to Authenticator hmac-secret enables the platform to retrieve a symmetric secret scoped Protocol (CTAP)] Section [W3C_Web_Authentication_Working_Group] to the credential from the authenticator. §12.5 HMAC Secret Extension (hmac-secret) This registration extension allows WebAuthn Relying Parties [Web Authentication] appidExclude to exclude authenticators that contain specified credentials Section §10.2, FIDO AppID [W3C_Web_Authentication_Working_Group] that were created with the legacy FIDO U2F JavaScript API Exclusion Extension [FIDOU2FJavaScriptAPI]. (appidExclude) This client registration extension enables reporting of a [Web Authentication] credProps newly-created credential's properties, as determined by the Section §10.4, Credential [W3C_Web_Authentication_Working_Group] client, to the calling WebAuthn Relying Party's web Properties Extension application. (credProps) This client registration extension and authentication [Web Authentication] largeBlob extension allows a Relying Party to store opaque data Section §10.5, Large blob [W3C_Web_Authentication_Working_Group] associated with a credential. storage extension (largeBlob) This extension supports the following functionality defined by the Secure Payment Confirmation API: (1) it allows credential creation in a cross-origin iframe (2) it allows a party other than the Relying Party to use the credential to [Secure Payment perform an authentication ceremony on behalf of the Relying Confirmation] Section §5, payment Party, and (3) it allows the browser to identify and cache WebAuthn Extension - [W3C_Web_Payments_Working_Group] Secure Payment Confirmation credentials. For discussion of "payment" important ways in which SPC differs from Web Authentication, see in particular [Secure Payment Confirmation §10 Security Considerations] and [Secure Payment Confirmation §11 Privacy Considerations]. Contact Information ID Name Contact URI Last Updated [W3C_Web_Authentication_Working_Group] W3C Web Authentication Working Group mailto:public-webauthn&w3.org 2022-02-28 [W3C_Web_Payments_Working_Group] W3C Web Payments Working Group mailto:public-payments-wg&w3.org 2023-09-13 Licensing Terms