Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

[Giridhar Mandyam <[e-mail]>]

Hi Ian,
> Apologies if I have missed this: what is the To Do item? Do you mean publication as a Candidate Recommendation?

Per  https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration:

"TODO: Find a better way to do this. Needed currently because other members are auth-time only"

> I’m not sure what you mean by “caching/freshness of assertions.” SPC does not involve caching of assertions. Is there a passage in the specification that is raising a concern?

"... and also allows the browser to identify and cache Secure Payment Confirmation credentials".  I may have overloaded the significance of what is intended behind caching of credentials.  I assumed that if credentials are cached then their usage (assertions) may also be cached.  

> We endeavor to address these topics in our Security Considerations [1] and Privacy Considerations [2] sections, including:

OK.  Might be good to put a reference to those sections in the extension registration.

-Giri

-----Original Message-----
From: Ian Jacobs <[e-mail]> 
Sent: Tuesday, May 23, 2023 8:49 AM
To: Giridhar Mandyam <[e-mail]>
Cc: [e-mail]; Stephen McGruer <[e-mail]>; Philippe Le Hégaret <[e-mail]>
Subject: Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

Hi Giri,

> On May 23, 2023, at 10:31 AM, Giridhar Mandyam <[e-mail]> wrote:
>
> Thanks Ian.
>
> I would like to see the "To Do"  item addressed before it is added to the registry.

Apologies if I have missed this: what is the To Do item? Do you mean publication as a Candidate Recommendation?

> There also seem to be some proposed departure from the Webauthn security model (e.g. strict RPID binding upon creation versus cross-origin iFrame registration, caching/freshness of assertions).  As per Sec. 2.2.1 of https://datatracker.ietf.org/doc/rfc8809/ requires a separate security/privacy considerations section to fully document such considerations.  Can you all make such an edit before CR?

We endeavor to address these topics in our Security Considerations [1] and Privacy Considerations [2] sections, including:

10.1: Cross-origin authentication ceremony 11.1. Registration in a Cross-Origin iframe

If there are subjects we are not adequately addressing there, perhaps we could jump on a call to discuss.

I’m not sure what you mean by “caching/freshness of assertions.” SPC does not involve caching of assertions. Is there a passage in the specification that is raising a concern?

Thanks again!

Ian

[1] https://w3c.github.io/secure-payment-confirmation/#sctn-security-considerations
[2] https://w3c.github.io/secure-payment-confirmation/#sctn-privacy-considerations

>
> -Giri
>
> -----Original Message-----
> From: Ian Jacobs <[e-mail]>
> Sent: Tuesday, May 23, 2023 5:48 AM
> To: Giridhar Mandyam <[e-mail]>
> Cc: [e-mail]; Stephen McGruer 
> <[e-mail]>; Philippe Le Hégaret <[e-mail]>
> Subject: Re: [Webauthn-reg-review] Request to add payment extension to 
> WebAuthn Registry
>
> WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.
>
> Hi Giri,
>
> I expect the specification to become a Candidate Recommendation the second week of June. I do not have a sense of when the final Recommendation will be published.
>
> While a Candidate Recommendation may still change it is "a document that satisfies the technical requirements of the Working Group that produced it and their dependencies, and has already received wide review.” [1]. There will be a “this version” URI for the publication, and that dated version of the specification will remain unchanged.
>
> Thank you,
> Ian
>
> [1] https://www.w3.org/2021/Process-20211102/#RecsCR
>
>> On May 23, 2023, at 3:36 AM, Giridhar Mandyam <[e-mail]> wrote:
>>
>> Thanks for the heads' up.  It looks like as per https://w3c.github.io/secure-payment-confirmation/#sctn-payment-extension-registration, it is still a work in progress.  Do you have insight as to when the extension specification will be complete?
>>
>> -Giri
>>
>> -----Original Message-----
>> From: Webauthn-reg-review <[e-mail]> On 
>> Behalf Of Ian Jacobs
>> Sent: Monday, May 22, 2023 7:58 AM
>> To: [e-mail]
>> Cc: Stephen McGruer <[e-mail]>; Philippe Le Hégaret 
>> <[e-mail]>
>> Subject: [Webauthn-reg-review] Request to add payment extension to 
>> WebAuthn Registry
>>
>> WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.
>>
>> Mike, Giridhar,
>>
>> The W3C Web Payments Working Group has received Director approval [1] to publish Secure Payment Confirmation (SPC) [2] as a Candidate Recommendation. We expect this publication to take place in early June.
>>
>> SPC defines a "payment" WebAuthn extension [3]. After discussion with the Web Authentication Working Group [4] we would like to register this extension in the WebAuthn Extension Identifiers registry [5], following the procedures defined in section 2.2.1 (Registering Extension Identifiers [6]) of RFC 8809 [7].
>>
>> Below is a draft of the information for the "payment" extension. I welcome your feedback on whether it satisfies the requirements for registration.
>>
>> I also have some questions:
>>
>> * My expectation is that we would first publish SPC as a Candidate Recommendation, then I would notify you to complete the registration. Does that work for you?
>>
>> * Because this will be the first extension registered by a group other than the Web Authentication Working Group, I have included a Note that the WebAuthn WG has discussed this extension (with a link to the meeting minutes). Is that useful?
>>
>> Thank you,
>>
>> Ian
>>
>> [1]
>> https://github.com/w3c/transitions/issues/504#issuecomment-1545729323
>> [2] https://w3c.github.io/secure-payment-confirmation/
>> [3]
>> https://w3c.github.io/secure-payment-confirmation/#sctn-payment-exten
>> s ion-registration [4] 
>> https://www.w3.org/2023/05/03-webauthn-minutes#t0
>> [5] https://www.iana.org/assignments/webauthn/webauthn.xhtml
>> [6] https://www.rfc-editor.org/rfc/rfc8809.html#section-2.2.1
>> [7] https://www.rfc-editor.org/rfc/rfc8809.html
>>
>> ========================
>> Extension identifier: payment
>>
>> Description: This extension supports the following functionality defined by the Secure Payment Confirmation API: (1) it allows credential creation in a cross-origin iframe (2) it allows a party other than the Relying Party to use the credential to perform an authentication ceremony on behalf of the Relying Party, and (3) it allows the browser to identify and cache Secure Payment Confirmation credentials.
>>
>> Reference: [<a href="https://www.w3.org/TR/secure-payment-confirmation/“>Secure Payment Confirmation</a>] Section §5, WebAuthn Extension - "payment"
>>
>> Change Controller: [<a
>> href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</
>> a
>>> ]
>>
>> Notes: Registration follows <a href="https://www.w3.org/2023/05/03-webauthn-minutes#t01">3 May 2023 discussion</a> with the Web Authentication Working Group.
>>
>> ========================
>> For Contact Information
>>
>> Id: [<a
>> href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</
>> a
>>> ]
>>
>> Name: W3C Web Payments Working Group
>>
>> Contact URI: mailto: [e-mail]
>>
>> Last Updated: <date>
>>
>> --
>> Ian Jacobs <[e-mail]>
>> https://www.w3.org/People/Jacobs/
>> Tel: [phone]
>>
>>
>>
>>
>>
>> --
>> Webauthn-reg-review mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/webauthn-reg-review
>
> --
> Ian Jacobs <[e-mail]>
> https://www.w3.org/People/Jacobs/
> Tel: [phone]
>
>
>
>
>

--
Ian Jacobs <[e-mail]>
https://www.w3.org/People/Jacobs/
Tel: [phone]