Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

[Giridhar Mandyam <[e-mail]>]

Hi Ian,

Mike needs to sign off,  but I have reviewed this an am satisfied that the extension can be registered.

Please consider removing the following in any future revision:

"Note: Reading [webauthn-3] literally, these steps don’t work; extensions are injected at step 12 of [[Create]] and cannot really modify anything. However other extensions ignore that entirely and assume they can modify any part of any WebAuthn algorithm!"

I don't think the above statement is an accurate reading of the WebAuthn spec, as the steps outlined in the Webauthn spec do not have to be executed in sequence.  This is because the cited section in Webauthn is for an internal method, which as per the ECMA description is left up to the implementation (https://tc39.es/ecma262/#sec-object-internal-methods-and-internal-slots).

Mike,
Please provide your feedback.

-Giri

-----Original Message-----
From: Ian Jacobs <[e-mail]> 
Sent: Monday, July 17, 2023 10:08 PM
To: Giridhar Mandyam <[e-mail]>; [e-mail]
Cc: [e-mail]; Stephen McGruer <[e-mail]>; Philippe Le Hégaret <[e-mail]>
Subject: Re: [Webauthn-reg-review] Request to add payment extension to WebAuthn Registry

WARNING: This email originated from outside of Qualcomm. Please be wary of any links or attachments, and do not enable macros.

Hi Giridhar and Michael,

I wanted to see whether there are any updates regarding this request to add the ‘payment’ extension to the WebAuthn extension registry. Thank you,

Ian

> On Jun 15, 2023, at 7:41 AM, Ian Jacobs <[e-mail]> wrote:
>
> Hi Giridhar and Michael,
>
> Today W3C published the Candidate Recommendation of Secure Payment Confirmation:
>  https://www.w3.org/TR/2023/CR-secure-payment-confirmation-20230615/
>
> With that publication I’d like to request addition of the “payment” extension to the WebAuthn registry.
>
> I have re-included below the proposed registry data. Please let me 
> know if you’d like any additional information or if anything needs correction.
>
> Thank you,
> Ian
>
> ========================
> Extension identifier: payment
>
> Description: This extension supports the following functionality defined by the Secure Payment Confirmation API: (1) it allows credential creation in a cross-origin iframe (2) it allows a party other than the Relying Party to use the credential to perform an authentication ceremony on behalf of the Relying Party, and (3) it allows the browser to identify and cache Secure Payment Confirmation credentials. For discussion of important ways in which SPC differs from Web Authentication, see in particular the <a href="https://www.w3.org/TR/secure-payment-confirmation/#sctn-security-considerations”>Security Considerations</a> and <a href="https://www.w3.org/TR/secure-payment-confirmation/#sctn-privacy-considerations”>Privacy Considerations</a>.
>
> Reference: [<a href="https://www.w3.org/TR/secure-payment-confirmation/“>Secure Payment Confirmation</a>] Section §5, WebAuthn Extension - "payment"
>
> Change Controller: [<a 
> href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a
> >]
>
> Notes: Registration follows <a href="https://www.w3.org/2023/05/03-webauthn-minutes#t01">3 May 2023 discussion</a> with the Web Authentication Working Group.
>
> ========================
> For Contact Information
>
> Id: [<a 
> href="https://www.w3.org/groups/wg/">W3C_Web_Payments_Working_Group</a
> >]
>
> Name: W3C Web Payments Working Group
>
> Contact URI: mailto: [e-mail]
>
> Last Updated: <date>
>
> --
> Ian Jacobs <[e-mail]>
> https://www.w3.org/People/Jacobs/
> Tel: [phone]
>
>
>
>
>

--
Ian Jacobs <[e-mail]>
https://www.w3.org/People/Jacobs/
Tel: [phone]