Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

[Giridhar Mandyam <[e-mail]>]

Thanks for the heads' up.  It looks like as per https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration, it is still a work in progress.  Do you have insight as to when the extension specification will be complete?

-Giri

-----Original Message-----
From: Webauthn-reg-review <[e-mail]> On Behalf Of Ian Jacobs
Sent: Monday, May 22, 2023 7:58 AM
To: [e-mail]
Cc: Stephen McGruer <[e-mail]>; Philippe Le Hégaret <[e-mail]>
Subject: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

Mike, Giridhar,

The W3C Web Payments Working Group has received Director approval [1] to publish Secure Payment Confirmation (SPC) [2] as a Candidate Recommendation. We expect this publication to take place in early June.

SPC defines a "payment" WebAuthn extension [3]. After discussion with the Web Authentication Working Group [4] we would like to register this extension in the WebAuthn Extension Identifiers registry [5], following the procedures defined in section 2.2.1 (Registering Extension Identifiers [6]) of RFC 8809 [7].

Below is a draft of the information for the "payment" extension. I welcome your feedback on whether it satisfies the requirements for registration.

I also have some questions:

* My expectation is that we would first publish SPC as a Candidate Recommendation, then I would notify you to complete the registration. Does that work for you?

* Because this will be the first extension registered by a group other than the Web Authentication Working Group, I have included a Note that the WebAuthn WG has discussed this extension (with a link to the meeting minutes). Is that useful?

Thank you,

Ian

[1] https://github.com/w3c/transitions/issues/504#issuecomment-1545729323
[2] https://w3c.github.io/secure-payment-confirmation/
[3] https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration
[4] https://www.w3.org/2023/05/03-webauthn-minutes#t0
[5] https://www.iana.org/assignments/webauthn/webauthn.xhtml
[6] https://www.rfc-editor.org/rfc/rfc8809.html#section-2.2.1
[7] https://www.rfc-editor.org/rfc/rfc8809.html

========================
Extension identifier: payment

Description: This extension supports the following functionality defined by the Secure Payment Confirmation API: (1) it allows credential creation in a cross-origin iframe (2) it allows a party other than the Relying Party to use the credential to perform an authentication ceremony on behalf of the Relying Party, and (3) it allows the browser to identify and cache Secure Payment Confirmation credentials.

Reference: [<a href="https://www.w3.org/TR/secure-payment-confirmation/“>Secure Payment Confirmation</a>] Section §5, WebAuthn Extension - "payment"

Change Controller: [<a href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a>]

Notes: Registration follows <a href="https://www.w3.org/2023/05/03-webauthn-minutes#t01">3 May 2023 discussion</a> with the Web Authentication Working Group.

========================
For Contact Information

Id: [<a href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a>]

Name: W3C Web Payments Working Group

Contact URI: mailto: [e-mail]

Last Updated: <date>

--
Ian Jacobs <[e-mail]>
https://www.w3.org/People/Jacobs/
Tel: [phone]





--
Webauthn-reg-review mailing list
[e-mail]
https://www.ietf.org/mailman/listinfo/webauthn-reg-review