required DOMString y;
};
3.1.9.1 Dictionary
JwkKey Members
kty of type required DOMString, defaulting to "EC"
Denotes the key type used for Channel ID. At this time only elliptic curve is supported by [
ChannelID], so it must be set to "EC"
[
JWA].
crv of type required DOMString, defaulting to "P-256"
Denotes the elliptic curve on which this public key is defined. At this time only the NIST curve
secp256r1 is supported by [ChannelID],
so the
crv parameter must be set to "P-256".
x of type required DOMString
Contains the base64url-encoding of the x coordinate of the public key (big-endian, 32-byte value).
y of type required DOMString
Contains the base64url-encoding of the y coordinate of the public key (big-endian, 32-byte value).
3.1.10 Extension dictionary
FIDO extensions can appear in several places, including the UAF protocol messages, authenticator commands, or in the assertion signed by
the authenticator.
Each extension has an identifier, and the namespace for extension identifiers is FIDO UAF global (i.e. doesn't depend on the message where
the extension is present).
Extensions can be defined in a way such that a processing entity which doesn't understand the meaning of a specific extension
must abort
processing, or they can be specified in a way that unknown extension can (safely) be ignored.
Extension processing rules are defined in each section where extensions are allowed.
Generic extensions used in various operations.
WebIDL
dictionary Extension {
required DOMString id;
required DOMString data;
required boolean fail_if_unknown;
};
3.1.10.1 Dictionary
Extension Members
id of type required DOMString
string[1..32].
Identifies the extension.
data of type required DOMString
Contains arbitrary data with a semantics agreed between server and client. Binary data is base64url-encoded.
This field
may be empty.
fail_if_unknown of type required boolean
Indicates whether unknown extensions must be ignored (false) or must lead to an error (true).
A value of false indicates that unknown extensions must be ignored
A value of true indicates that unknown extensions must result in an error.
3.1.11 MatchCriteria dictionary
Represents the matching criteria to be used in the server policy.
NOTE
The FIDO UAF Client might (a) process an extension or (b) pass the extension through to the ASM. Unknown extensions must be
passed through.
The ASM might (a) process an extension or (b) pass the extension through to the FIDO authenticator. Unknown extensions must be
passed through.
The FIDO authenticator must handle the extension or ignore it (only if it doesn't know how to handle it and
fail_if_unknown is not set). If
the FIDO authenticator doesn't understand the meaning of the extension and
fail_if_unknown is set, it must generate an error (see
definition of
fail_if_unknown above).
When passing through an extension to the next entity, the
fail_if_unknown flag must be preserved (see [UAFASM]
[
UAFAuthnrCommands]).
FIDO protocol messages are not signed. If the security depends on an extension being known or processed, then such extension should
be accompanied by a related (and signed) extension in the authenticator assertion (e.g.
TAG_UAFV1_REG_ASSERTION,
TAG_UAFV1_AUTH_ASSERTION). If the security has been increased (e.g. the FIDO authenticator according to the description in the metadata
statement accepts multiple fingers but in this specific case indicates that the finger used at registration was also used for authentication)
there is no need to mark the extension as
fail_if_unknown (i.e. tag 0x3E12 should be used [UAFAuthnrCommands]). If the security has
been degraded (e.g. the FIDO authenticator according to the description in the metadata statement accepts only the finger used at
registration for authentication but in this specific case indicates that a different finger was used for authentication) the extension must be
marked as
fail_if_unknown (i.e. tag 0x3E11 must be used [UAFAuthnrCommands]).