Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Add note about possible sensitive data in extensions #2178

Closed
wants to merge 1 commit into from
Closed

Add note about possible sensitive data in extensions #2178

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 12 additions & 0 deletions index.bs
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5997,6 +5997,12 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o

Note: Since all extensions are OPTIONAL for both the [=client=] and the [=authenticator=], the [=[RP]=] MUST also be
prepared to handle cases where none or not all of the requested extensions were acted upon.

Note: Since some extension data may need to remain client-side, [=[RPS]=] MUST be prepared to remove data in
|clientExtensionResults| client-side before sending data to the server for ceremony completion. Since signatures are
based on |authData|, the [=[RP]=] MUST NOT rely on extensions whose corresponding [=authenticator extension outputs=]
in the <code>[=authData/extensions=]</code> in |authData| contains data that should remain client-side when relying on
the server to complete the ceremony.
</li>

1. Determine the attestation statement format by performing a USASCII case-sensitive match on |fmt| against the set of
Expand Down Expand Up @@ -6228,6 +6234,12 @@ a numbered step. If outdented, it (today) is rendered as a bullet in the midst o

Note: Since all extensions are OPTIONAL for both the [=client=] and the [=authenticator=], the [=[RP]=] MUST also be
prepared to handle cases where none or not all of the requested extensions were acted upon.

Note: Since some extension data may need to remain client-side, [=[RPS]=] MUST be prepared to remove data in
|clientExtensionResults| client-side before sending data to the server for ceremony completion. Since signatures are
based on |authData|, the [=[RP]=] MUST NOT rely on extensions whose corresponding [=authenticator extension outputs=]
in the <code>[=authData/extensions=]</code> in |authData| contains data that should remain client-side when relying on
the server to complete the ceremony.
</li>

1. Let |hash| be the result of computing a hash over the |cData| using SHA-256.
Expand Down