[Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

[Ian Jacobs <[e-mail]>]

Mike, Giridhar,

The W3C Web Payments Working Group has received Director approval [1] to publish Secure Payment Confirmation (SPC) [2] as a Candidate Recommendation. We expect this publication to take place in early June.

SPC defines a "payment" WebAuthn extension [3]. After discussion with the Web Authentication Working Group [4] we would like to register this extension in the WebAuthn Extension Identifiers registry [5], following the procedures defined in section 2.2.1 (Registering Extension Identifiers [6]) of RFC 8809 [7].

Below is a draft of the information for the "payment" extension. I welcome your feedback on whether it satisfies the requirements for registration.

I also have some questions:

* My expectation is that we would first publish SPC as a Candidate Recommendation, then I would notify you to complete the registration. Does that work for you?

* Because this will be the first extension registered by a group other than the Web Authentication Working Group, I have included a Note that the WebAuthn WG has discussed this extension (with a link to the meeting minutes). Is that useful?

Thank you,

Ian

[1] https://github.com/w3c/transitions/issues/504#issuecomment-1545729323
[2] https://w3c.github.io/secure-payment-confirmation/
[3] https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration
[4] https://www.w3.org/2023/05/03-webauthn-minutes#t0
[5] https://www.iana.org/assignments/webauthn/webauthn.xhtml
[6] https://www.rfc-editor.org/rfc/rfc8809.html#section-2.2.1
[7] https://www.rfc-editor.org/rfc/rfc8809.html

========================
Extension identifier: payment

Description: This extension supports the following functionality defined by the Secure Payment Confirmation API: (1) it allows credential creation in a cross-origin iframe (2) it allows a party other than the Relying Party to use the credential to perform an authentication ceremony on behalf of the Relying Party, and (3) it allows the browser to identify and cache Secure Payment Confirmation credentials.

Reference: [<a href="https://www.w3.org/TR/secure-payment-confirmation/“>Secure Payment Confirmation</a>] Section §5, WebAuthn Extension - "payment"

Change Controller: [<a href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a>]

Notes: Registration follows <a href="https://www.w3.org/2023/05/03-webauthn-minutes#t01">3 May 2023 discussion</a> with the Web Authentication Working Group.

========================
For Contact Information

Id: [<a href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a>]

Name: W3C Web Payments Working Group

Contact URI: mailto: [e-mail]

Last Updated: <date>

--
Ian Jacobs <[e-mail]>
https://www.w3.org/People/Jacobs/
Tel: [phone]