- | W3C WebAuthn Working Group |
- J. Hodges |
+W3C WebAuthn Working Group |
+J. Hodges |
- | Internet-Draft |
- PayPal |
+Internet-Draft |
+PayPal |
- | Intended status: Informational |
- G. Mandyam |
+Intended status: Informational |
+G. Mandyam |
- | Expires: September 25, 2017 |
- Qualcomm Technologies Inc. |
+Expires: August 31, 2018 |
+Qualcomm Technologies Inc. |
- |
- M. Jones |
+ |
+M. Jones |
- |
- Microsoft |
+ |
+Microsoft |
- |
- March 24, 2017 |
+ |
+February 27, 2018 |
@@ -436,91 +436,104 @@
Registries for Web Authentication (WebAuthn)
- draft-hodges-webauthn-registries-00
+ draft-hodges-webauthn-registries-01
-
+
This specification defines IANA registries for W3C Web Authentication attestation statement formats and extension identifiers.
-
+
This Internet-Draft is submitted in full conformance with the provisions of BCP 78 and BCP 79.
-Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at http://datatracker.ietf.org/drafts/current/.
+Internet-Drafts are working documents of the Internet Engineering Task Force (IETF). Note that other groups may also distribute working documents as Internet-Drafts. The list of current Internet-Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months and may be updated, replaced, or obsoleted by other documents at any time. It is inappropriate to use Internet-Drafts as reference material or to cite them other than as "work in progress."
-This Internet-Draft will expire on September 25, 2017.
-
-Copyright (c) 2017 IETF Trust and the persons identified as the document authors. All rights reserved.
-This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
+This Internet-Draft will expire on August 31, 2018.
+
+Copyright (c) 2018 IETF Trust and the persons identified as the document authors. All rights reserved.
+This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info) in effect on the date of publication of this document. Please review these documents carefully, as they describe your rights and restrictions with respect to this document. Code Components extracted from this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions and are provided without warranty as described in the Simplified BSD License.
-
-This specification establishes IANA registries for W3C Web Authentication [WebAuthn] attestation statement formats and extension identifiers. The initial values for these registries are in the IANA Considerations section of the [WebAuthn] specification.
-
-WebAuthn attestation statement format identifiers are strings whose semantic, syntactic, and string-matching criteria are specified in [WebAuthn], along with the concepts of attestation and attestation statement formats.
-WebAuthn attestation statement formats are registered on the advice of a Designated Expert (appointed by the IESG or their delegate), with a Specification Required (per [RFC5226]).
+
+This specification establishes IANA registries for W3C Web Authentication [WebAuthn] attestation statement formats and extension identifiers. The initial values for these registries are in the IANA Considerations section of the [WebAuthn] specification.
+
+WebAuthn attestation statement format identifiers are strings whose semantic, syntactic, and string-matching criteria are specified in [WebAuthn], along with the concepts of attestation and attestation statement formats.
+WebAuthn attestation statement formats are registered on the advice of a Designated Expert (appointed by the IESG or their delegate), with a Specification Required (per [RFC5226]).
The Expert(s) will establish procedures for requesting registrations, and make them available from the registry page.
Registration requests consist of at least the following information:
- - WebAuthn Attestation Statement Format Identifier: This identifier MUST be a maximum of 32 octets in length and MUST consist only of printable USASCII characters, excluding backslash and doublequote. This name is case sensitive. Names may not match other registered names in a case-insensitive manner unless the Designated Experts state that there is a compelling reason to allow an exception.
- - Description: A relatively short description of the attestation format.
- - Specification Document: Reference to the specification of the attestation statement format.
- - Notes: [optional]
+- WebAuthn Attestation Statement Format Identifier: This identifier MUST be a maximum of 32 octets in length and MUST consist only of printable USASCII characters, excluding backslash and doublequote. This name is case sensitive. Names may not match other registered names in a case-insensitive manner unless the Designated Experts state that there is a compelling reason to allow an exception.
+- Description: A relatively short description of the attestation format.
+- Specification Document: Reference to the specification of the attestation statement format.
+- Notes: [optional]
The Expert(s) MAY define additional fields to be collected in the registry. Each attestation statement format identifier added to this registry MUST be unique amongst the set of registered attestation statement format identifiers. The Experts(s) MAY also designate attestation statement formats as proprietary if they lack complete specifications, and will assign a prefix indicating as such to the identifier.
-Registrations MUST reference a freely available specification, e.g., as described in [RFC2026] Section 7.
+Registrations MUST reference a freely available specification, e.g., as described in [RFC2026] Section 7.
Note that WebAuthn attestation statement formats can be registered by third parties, if the Expert(s) determine that an unregistered attestation statement format is widely deployed and not likely to be registered in a timely manner.
Decisions (or lack thereof) made by the Designated Expert can be first appealed to Application Area Directors (contactable using app-ads@tools.ietf.org email address or directly by looking up their email addresses on http://www.iesg.org/ website) and, if the appellant is not satisfied with the response, to the full IESG (using the iesg@iesg.org mailing list).
-
-
-WebAuthn extension identifiers are strings whose semantic, syntactic, and string-matching criteria are specified in [WebAuthn].
-WebAuthn extension identifiers are registered on the advice of a Designated Expert (appointed by the IESG or their delegate), with a Specification Required (per [RFC5226]).
+
+
+WebAuthn extension identifiers are strings whose semantic, syntactic, and string-matching criteria are specified in [WebAuthn].
+WebAuthn extension identifiers are registered on the advice of a Designated Expert (appointed by the IESG or their delegate), with a Specification Required (per [RFC5226]).
The Expert(s) will establish procedures for requesting registrations, and make them available from the registry page.
Registration requests consist of at least the following information:
- - WebAuthn Extension Identifier: This identifier MUST be a maximum of 32 octets in length and MUST consist only of printable USASCII characters, excluding backslash and doublequote. This name is case sensitive. Names may not match other registered names in a case-insensitive manner unless the Designated Experts state that there is a compelling reason to allow an exception.
- - Description: A relatively short description of the extension.
- - Specification Document: Reference to the specification of the extension.
- - Notes: [optional]
+- WebAuthn Extension Identifier: This identifier MUST be a maximum of 32 octets in length and MUST consist only of printable USASCII characters, excluding backslash and doublequote. This name is case sensitive. Names may not match other registered names in a case-insensitive manner unless the Designated Experts state that there is a compelling reason to allow an exception.
+- Description: A relatively short description of the extension.
+- Specification Document: Reference to the specification of the extension.
+- Notes: [optional]
The Expert(s) MAY define additional fields to be collected in the registry. Each extension identifier added to this registry MUST be unique amongst the set of registered extension identifiers.
-Registrations MUST reference a freely available specification, e.g., as described in [RFC2026] Section 7.
+Registrations MUST reference a freely available specification, e.g., as described in [RFC2026] Section 7.
Note that WebAuthn extensions can be registered by third parties, if the Expert(s) determine that an unregistered extension is widely deployed and not likely to be registered in a timely manner.
Decisions (or lack thereof) made by the Designated Expert can be first appealed to Application Area Directors (contactable using app-ads@tools.ietf.org email address or directly by looking up their email addresses on http://www.iesg.org/ website) and, if the appellant is not satisfied with the response, to the full IESG (using the iesg@iesg.org mailing list).
-
-
-
+
+
This specification establishes two registries:
- - the "WebAuthn Attestation Statement Format Identifier" registry; see Section 2.
- - the "WebAuthn Extension Identifier" registry; see Section 3.
+- the "WebAuthn Attestation Statement Format Identifier" registry; see Section 2.
+- the "WebAuthn Extension Identifier" registry; see Section 3.
For both registries, the Expert(s) and IANA will interact as outlined below:
@@ -528,9 +541,9 @@
-
-
- |
- [RFC2026]
- |
- Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, DOI 10.17487/RFC2026, October 1996. |
-
-
- |
- [RFC5226]
- |
- Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", BCP 26, RFC 5226, DOI 10.17487/RFC5226, May 2008. |
-
-
- |
- [WebAuthn]
- |
- Bharadwaj, V., Le Van Gong, H., Balfanz, D., Czeskis, A., Birgisson, A., Hodges, J., Jones, M. and R. Lindemann, "Web Authentication: An API for accessing Scoped Credentials", Editors' Draft, World Wide Web Consortium (W3C) Recommendation-track, Mar 2017. |
-
-
-
-
+-00
+
+
+
+
+
+8. Normative References
+
+
+| [RFC2026] |
+
+Bradner, S., "The Internet Standards Process -- Revision 3", BCP 9, RFC 2026, DOI 10.17487/RFC2026, October 1996. |
+
+
+| [RFC5226] |
+
+Narten, T. and H. Alvestrand, "Guidelines for Writing an IANA Considerations Section in RFCs", RFC 5226, DOI 10.17487/RFC5226, May 2008. |
+
+
+| [WebAuthn] |
+
+Balfanz, D., Czeskis, A., Hodges, J., Jones, J., Jones, M., Kumar, A., Liao, A., Lindemann, R. and E. Lundberg, "Web Authentication: An API for accessing Public Key Credentials", Editors' Draft, World Wide Web Consortium (W3C) Recommendation-track, February 2018. |
+
+
+
diff --git a/draft-hodges-webauthn-registries.txt b/draft-hodges-webauthn-registries.txt
index 3388f8313..483c3fc76 100644
--- a/draft-hodges-webauthn-registries.txt
+++ b/draft-hodges-webauthn-registries.txt
@@ -5,14 +5,14 @@
W3C WebAuthn Working Group J. Hodges
Internet-Draft PayPal
Intended status: Informational G. Mandyam
-Expires: September 25, 2017 Qualcomm Technologies Inc.
+Expires: August 31, 2018 Qualcomm Technologies Inc.
M. Jones
Microsoft
- March 24, 2017
+ February 27, 2018
Registries for Web Authentication (WebAuthn)
- draft-hodges-webauthn-registries-00
+ draft-hodges-webauthn-registries-01
Abstract
@@ -27,23 +27,23 @@ Status of This Memo
Internet-Drafts are working documents of the Internet Engineering
Task Force (IETF). Note that other groups may also distribute
working documents as Internet-Drafts. The list of current Internet-
- Drafts is at http://datatracker.ietf.org/drafts/current/.
+ Drafts is at https://datatracker.ietf.org/drafts/current/.
Internet-Drafts are draft documents valid for a maximum of six months
and may be updated, replaced, or obsoleted by other documents at any
time. It is inappropriate to use Internet-Drafts as reference
material or to cite them other than as "work in progress."
- This Internet-Draft will expire on September 25, 2017.
+ This Internet-Draft will expire on August 31, 2018.
Copyright Notice
- Copyright (c) 2017 IETF Trust and the persons identified as the
+ Copyright (c) 2018 IETF Trust and the persons identified as the
document authors. All rights reserved.
This document is subject to BCP 78 and the IETF Trust's Legal
Provisions Relating to IETF Documents
- (http://trustee.ietf.org/license-info) in effect on the date of
+ (https://trustee.ietf.org/license-info) in effect on the date of
publication of this document. Please review these documents
carefully, as they describe your rights and restrictions with respect
to this document. Code Components extracted from this document must
@@ -53,9 +53,9 @@ Copyright Notice
-Hodges, et al. Expires September 25, 2017 [Page 1]
+Hodges, et al. Expires August 31, 2018 [Page 1]
-Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
+Internet-DraftRegistries for Web Authentication (WebAuthn) February 2018
Table of Contents
@@ -109,9 +109,9 @@ Table of Contents
-Hodges, et al. Expires September 25, 2017 [Page 2]
+Hodges, et al. Expires August 31, 2018 [Page 2]
-Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
+Internet-DraftRegistries for Web Authentication (WebAuthn) February 2018
The Expert(s) MAY define additional fields to be collected in the
@@ -165,9 +165,9 @@ Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
-Hodges, et al. Expires September 25, 2017 [Page 3]
+Hodges, et al. Expires August 31, 2018 [Page 3]
-Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
+Internet-DraftRegistries for Web Authentication (WebAuthn) February 2018
The Expert(s) MAY define additional fields to be collected in the
@@ -188,7 +188,6 @@ Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
appellant is not satisfied with the response, to the full IESG (using
the iesg@iesg.org mailing list).
-
4. IANA Considerations
4.1. WebAuthn Attestation Statement Format Identifier and Extension
@@ -221,9 +220,10 @@ Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
-Hodges, et al. Expires September 25, 2017 [Page 4]
+
+Hodges, et al. Expires August 31, 2018 [Page 4]
-Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
+Internet-DraftRegistries for Web Authentication (WebAuthn) February 2018
Additionally, the HTML generated by IANA will:
@@ -244,11 +244,18 @@ Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
6. Acknowledgements
Thanks to Mark Nottingham for valuable comments and suggestions.
+ Thanks to Kathleen Moriarty and Benjamin Kaduk for their Area
+ Director sponsorship of this specification.
7. Document History
[[ to be removed by the RFC Editor before publication as an RFC ]]
+ -01
+
+ o Refresh now that the WebAuthn Committee Recommendation (CR) draft
+ is pending.
+
-00
o Initial version.
@@ -257,31 +264,32 @@ Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
[RFC2026] Bradner, S., "The Internet Standards Process -- Revision
3", BCP 9, RFC 2026, DOI 10.17487/RFC2026, October 1996,
- .
+ .
[RFC5226] Narten, T. and H. Alvestrand, "Guidelines for Writing an
- IANA Considerations Section in RFCs", BCP 26, RFC 5226,
+ IANA Considerations Section in RFCs", RFC 5226,
DOI 10.17487/RFC5226, May 2008,
- .
+ .
- [WebAuthn]
- Bharadwaj, V., Le Van Gong, H., Balfanz, D., Czeskis, A.,
- Birgisson, A., Hodges, J., Jones, M., and R. Lindemann,
- "Web Authentication: An API for accessing Scoped
- Credentials", Editors' Draft, World Wide Web Consortium
- (W3C) Recommendation-track, Mar 2017,
- .
-Hodges, et al. Expires September 25, 2017 [Page 5]
+Hodges, et al. Expires August 31, 2018 [Page 5]
-Internet-DraftRegistries for Web Authentication (WebAuthn) March 2017
+Internet-DraftRegistries for Web Authentication (WebAuthn) February 2018
+ [WebAuthn]
+ Balfanz, D., Czeskis, A., Hodges, J., Jones, J., Jones,
+ M., Kumar, A., Liao, A., Lindemann, R., and E. Lundberg,
+ "Web Authentication: An API for accessing Public Key
+ Credentials", Editors' Draft, World Wide Web Consortium
+ (W3C) Recommendation-track, February 2018,
+ .
+
Authors' Addresses
Jeff Hodges
@@ -325,12 +333,4 @@ Authors' Addresses
-
-
-
-
-
-
-
-
-Hodges, et al. Expires September 25, 2017 [Page 6]
+Hodges, et al. Expires August 31, 2018 [Page 6]
diff --git a/draft-hodges-webauthn-registries.xml b/draft-hodges-webauthn-registries.xml
index dbcd097bc..d7ba53ef8 100644
--- a/draft-hodges-webauthn-registries.xml
+++ b/draft-hodges-webauthn-registries.xml
@@ -21,7 +21,7 @@
-00d: Let initial values be in the [WebAuthn] spec, rather than here.
-->
-
+
Registries for Web Authentication (WebAuthn)
@@ -65,7 +65,7 @@
-
+
Security
W3C WebAuthn Working Group
@@ -164,8 +164,6 @@
-
-
@@ -227,15 +225,7 @@
the iesg@iesg.org mailing list).
-
-
-
-
-
-
-
-
-
-
@@ -307,12 +295,22 @@
Thanks to Mark Nottingham
for valuable comments and suggestions.
+ Thanks to Kathleen Moriarty and Benjamin Kaduk for their Area Director sponsorship of this specification.
[[ to be removed by the RFC Editor before publication as an RFC ]]
+
+ -01
+
+
+ Refresh now that the WebAuthn Committee Recommendation (CR) draft is pending.
+
+
+
+
-00
@@ -334,64 +332,72 @@
- Web Authentication: An API for accessing Scoped Credentials
-
- Microsoft
+ Web Authentication: An API for accessing Public Key Credentials
+
+ Google
- vijay.bharadwaj@microsoft.com
+ balfanz@google.com
-
- PayPal
+
+ Google
- hlevangong@paypal.com
+ aczeskis@google.com
-
- Google
+
+ PayPal
- balfanz@google.com
+ Jeff.Hodges@paypal.com
-
- Google
+
+ Mozilla
- aczeskis@google.com
+ jc@mozilla.com
-
- Google
+
+ Microsoft
- arnarb@google.com
+ mbj@microsoft.com
+ http://self-issued.info/
-
- PayPal
+
+ Microsoft
- Jeff.Hodges@paypal.com
+ akshayku@microsoft.com
-
+
Microsoft
- mbj@microsoft.com
+ huliao@microsoft.com
-
+
Nok Nok Labs
rolf@noknok.com
-
+
+ Yubico
+
+ emil@yubico.com
+
+
+
+