RFC 8809

Registries for Web Authentication (WebAuthn)

📅 published August 2020, from ietf

Registries for Web Authentication (WebAuthn) 🎀

Okay bestie, let's get into it. This is RFC 8809 from the IETF, published in August 2020 🌸. It was written by J. Hodges (Google), G. Mandyam (Qualcomm Technologies Inc.), and M. Jones (Microsoft). It's marked Informational, which means it's published for information and isn't an Internet Standards Track spec ✨. Its ISSN is 2070-1721. The title block doesn't list anything this document obsoletes or updates, so it's standing on its own 💅.

Abstract ✨

This spec sets up IANA registries for the W3C Web Authentication (WebAuthn) attestation statement format identifiers and extension identifiers 🦋. Basically it's the official list-keeping system for these identifiers.

Status of This Memo 🌈

This document isn't an Internet Standards Track spec. It's out there purely for information 💜.

It's a product of the IETF, so it represents the consensus of the IETF community. It went through public review and got approved for publication by the Internet Engineering Steering Group (IESG) 🫶. Not every IESG-approved doc is a candidate for any level of Internet Standard, though, so check out Section 2 of RFC 7841 if you want the full tea on that 🍵.

For the current status, any errata, and how to give feedback, go to https://www.rfc-editor.org/info/rfc8809 🔥.

Copyright (c) 2020 IETF Trust and the persons identified as the document authors. All rights reserved 🔒.

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (https://trustee.ietf.org/license-info), as in effect on the date of publication. Please read these carefully, because they spell out your rights and restrictions for this document 📜. Code Components pulled out of this document must include Simplified BSD License text as described in Section 4.e of the Trust Legal Provisions, and they're provided without warranty as described in the Simplified BSD License 💅.

Table of Contents 🧚

1.  Introduction
  1.1.  Requirements Notation and Conventions
2.  IANA Considerations
  2.1.  WebAuthn Attestation Statement Format Identifiers Registry
    2.1.1.  Registering Attestation Statement Format Identifiers
    2.1.2.  Registration Request Processing
    2.1.3.  Initial Values in the WebAuthn Attestation Statement
            Format Identifiers Registry
  2.2.  WebAuthn Extension Identifiers Registry
    2.2.1.  Registering Extension Identifiers
    2.2.2.  Registration Request Processing
    2.2.3.  Initial Values in the WebAuthn Extension Identifiers
            Registry
3.  Security Considerations
4.  Normative References
Acknowledgements
Authors' Addresses

1. Introduction ✨

So this spec establishes IANA registries for the W3C Web Authentication attestation statement format identifiers and extension identifiers, which are defined in [WebAuthn] 🦋. The starting values for these registries live in the IANA Considerations section of the [WebAuthn] spec 🎀.

1.1. Requirements Notation and Conventions 💅

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in BCP 14 [RFC2119] [RFC8174] when, and only when, they appear in all capitals, as shown here 🧠. Lowercase versions just mean regular words, so no pressure 🙈.

2. IANA Considerations 🎀

This spec sets up two registries 👑:

  • the "WebAuthn Attestation Statement Format Identifiers" registry (see Section 2.1) 🌸
  • the "WebAuthn Extension Identifiers" registry (see Section 2.2) 🌈

Any extra processes the expert(s) set up after this document gets published will be recorded on the registry web page, at the expert(s)' discretion ✨.

2.1. WebAuthn Attestation Statement Format Identifiers Registry 🦋

WebAuthn attestation statement format identifiers are strings with their semantic, syntactic, and string-matching criteria spelled out in the "Attestation Statement Format Identifiers" section of [WebAuthn] (https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#sctn-attstn-fmt-ids), along with the concepts of attestation and attestation statement formats 💖.

Registered attestation statement format identifiers are the ones that got added to the registry by following the procedure in Section 2.1.1 🫶.

Each attestation statement format identifier added to this registry MUST be unique amongst the set of registered attestation statement format identifiers 🔒.

Registered attestation statement format identifiers MUST be a maximum of 32 octets in length and MUST consist only of printable ASCII [RFC20] characters, excluding backslash and double quote. Basically that's VCHAR as defined in [RFC5234], but without %x22 and %x5c 💅. Attestation statement format identifiers are case sensitive, and they may not match other registered identifiers in a case-insensitive manner unless the designated experts determine there's a compelling reason to allow an exception 👀.

2.1.1. Registering Attestation Statement Format Identifiers 🌷

WebAuthn attestation statement format identifiers are registered using the Specification Required policy (see Section 4.6 of [RFC8126]) 📝.

The "WebAuthn Attestation Statement Format Identifiers" registry lives at https://www.iana.org/assignments/webauthn. You can make registration requests by following the instructions there, or by emailing the webauthn-reg-review@ietf.org mailing list 📬.

Registration requests have to include at least this info 💌:

  • WebAuthn Attestation Statement Format Identifier: An identifier that meets the requirements given in Section 2.1 ✨.
  • Description: A relatively short description of the attestation format 🌸.
  • Specification Document(s): A reference to the document or documents that specify the attestation statement format 📚.
  • Change Controller: For Standards Track RFCs, list "IETF". For others, give the name of the responsible party. Other details (for example, postal address, email address, or home page URI) may also be included 🏠.
  • Notes: [optional] 🍓.

Registrations MUST reference a freely available, stable specification, for example as described in Section 4.6 of [RFC8126]. This specification MUST include security and privacy considerations relevant to the attestation statement format 🔐. No skipping this part, periodt 💅.

Heads up: WebAuthn attestation statement format identifiers can be registered by third parties (including the expert(s) themselves) if the expert(s) determine that an unregistered attestation statement format is widely deployed and unlikely to be registered in a timely manner otherwise 👑. Those registrations still have to follow the requirements, including referencing a specification 🫶.

2.1.2. Registration Request Processing 🧁

As noted in Section 2.1.1, WebAuthn attestation statement format identifiers are registered using the Specification Required policy 🔁.

The expert(s) will clearly identify any issues that cause a registration to be refused, like an incompletely specified attestation format 🙅‍♀️.

When a request gets approved, the expert(s) will inform IANA, and then the registration gets processed. The IESG is the arbiter of any objection ⚖️.

2.1.3. Initial Values in the WebAuthn Attestation Statement Format Identifiers Registry 🌟

The initial values for the "WebAuthn Attestation Statement Format Identifiers" registry were populated with the values listed in the "WebAuthn Attestation Statement Format Identifier Registrations" section of [WebAuthn] (https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#sctn-att-fmt-reg). Also, the Change Controller entry for each of those registrations is:

  • Change Controller: W3C Web Authentication Working Group (public-webauthn@w3.org) 💜

2.2. WebAuthn Extension Identifiers Registry 🌈

WebAuthn extension identifiers are strings whose semantic, syntactic, and string-matching criteria are specified in the "Extension Identifiers" section of [WebAuthn] (https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#sctn-extension-id) 🦋.

Registered extension identifiers are the ones that got added to the registry by following the procedure in Section 2.2.1 🫶.

Each extension identifier added to this registry MUST be unique amongst the set of registered extension identifiers 🔑.

Registered extension identifiers MUST be a maximum of 32 octets in length and MUST consist only of printable ASCII characters, excluding backslash and double quote. That's VCHAR as defined in [RFC5234], but without %x22 and %x5c 💅. Extension identifiers are case sensitive, and they may not match other registered identifiers in a case-insensitive manner unless the designated experts determine there's a compelling reason to allow an exception 👀.

2.2.1. Registering Extension Identifiers 🌷

WebAuthn extension identifiers are registered using the Specification Required policy (see Section 4.6 of [RFC8126]) 📝.

The "WebAuthn Extension Identifiers" registry lives at https://www.iana.org/assignments/webauthn. You can make registration requests by following the instructions there, or by emailing the webauthn-reg-review@ietf.org mailing list 📬.

Registration requests have to include at least this info 💌:

  • WebAuthn Extension Identifier: An identifier that meets the requirements given in Section 2.2 ✨.
  • Description: A relatively short description of the extension 🌸.
  • Specification Document(s): A reference to the document or documents that specify the extension 📚.
  • Change Controller: For Standards Track RFCs, list "IETF". For others, give the name of the responsible party. Other details (for example, postal address, email address, or home page URI) may also be included 🏠.
  • Notes: [optional] 🍓.

Registrations MUST reference a freely available, stable specification, for example as described in Section 4.6 of [RFC8126]. This specification MUST include security and privacy considerations relevant to the extension 🔐.

Note that WebAuthn extensions can be registered by third parties (including the expert(s) themselves) if the expert(s) determine that an unregistered extension is widely deployed and unlikely to be registered in a timely manner otherwise 👑. Those registrations still have to follow the requirements, including referencing a specification 🫶.

2.2.2. Registration Request Processing 🧁

As noted in Section 2.2.1, WebAuthn extension identifiers are registered using the Specification Required policy 🔁.

The expert(s) will clearly identify any issues that cause a registration to be refused, like an incompletely specified extension 🙅‍♀️.

When a request gets approved, the expert(s) will inform IANA, and then the registration gets processed. The IESG is the arbiter of any objection ⚖️.

2.2.3. Initial Values in the WebAuthn Extension Identifiers Registry 🌟

The initial values for the "WebAuthn Extension Identifiers" registry were populated with the values listed in the "WebAuthn Extension Identifier Registrations" section of [WebAuthn] (https://www.w3.org/TR/2019/REC-webauthn-1-20190304/#sctn-extensions-reg). Also, the Change Controller entry for each of those registrations is:

  • Change Controller: W3C Web Authentication Working Group (public-webauthn@w3.org) 💜

3. Security Considerations 💀

Okay, this part is serious. Go read [WebAuthn] for the relevant security considerations, because they matter a lot for attestation and extensions 🚨.

4. Normative References ✨

okay bestie, this is the reading list 📚 the stuff you have to know to fully get the spec. Here are the normative references, with all their details:

Acknowledgements 🫶

Huge thanks to Mark Nottingham for the super valuable comments and suggestions 💖 Thanks also to Kathleen Moriarty and Benjamin Kaduk for their Area Director sponsorship of this spec ✨ And a big group hug for Amanda Baber, Sarah Banks, Alissa Cooper, Roman Danyliw, Murray Kucherawy, Paul Kyzivat, Barry Leiba, Hilarie Orman, Magnus Westerlund, and Robert Wilton for all their reviews. The people who read the drafts and told the authors what was up are literally the real MVPs 😭

Authors' Addresses 💅

Here's where you can find the authors, in case you want to slide into their inbox 📬

Jeff Hodges
Google
1600 Amphitheatre Parkway
Mountain View, CA 94043
United States of America

Email: jdhodges@google.com
URI:   https://kingsmountain.com/people/Jeff.Hodges/
Giridhar Mandyam
Qualcomm Technologies Inc.
5775 Morehouse Drive
San Diego, CA 92121
United States of America

Phone: +1 858 651 7200
Email: mandyam@qti.qualcomm.com
Michael B. Jones
Microsoft

Email: mbj@microsoft.com
URI:   https://self-issued.info/

and that's the whole spec, babe 🌈 literally iconic work from these three 👑

📦 where this page comes from