Emil Lundberg

> Doesn't `"hybrid"` mean both `"platform"` and `"cross-platform"` are allowed without preference to either one? No, the [`"hybrid"` hint](https://www.w3.org/TR/webauthn-3/#dom-publickeycredentialhints-hybrid) indicates a preference for a separate authenticator device using the [`"hybrid"`...

2024-05-15 WG call: - This seems like an accurate observation. - This was changed in PR #1932. - Empty values tend to lead to interop problems, we should revert that...

Ah, ok. In that case it's probably worth mentioning in the `{{ClientCapability/enterpriseAttestation}}` definition that the presence of this capability is no guarantee that the client's/authenticator's policy allows EA for the...

It is defined under "[**Authenticators perform the following steps to generate an authenticator data structure**](https://www.w3.org/TR/webauthn-3/#authenticator-data-perform-the-following-steps-to-generate-an-authenticator-data-structure)" that: >- The [UP](https://www.w3.org/TR/webauthn-3/#authdata-flags-up) [flag](https://www.w3.org/TR/webauthn-3/#authdata-flags) SHALL be set if and only if [...]. The RFU...

@zacknewman Not all requirements can be enforced in-protocol. Authenticators are required to set the RFU bits to zero for now, but RPs should not enforce this behaviour since that would...

Thanks for pointing this out! 2024-05-15 WG call: [`AuthenticatorAttestationResponseJSON`](https://www.w3.org/TR/webauthn-3/#dictdef-authenticatorattestationresponsejson) was added in the L3 drafts, so we can easily change [`AuthenticatorAttestationResponseJSON.publicKeyAlgorithm`](https://www.w3.org/TR/webauthn-3/#dom-authenticatorattestationresponsejson-publickeyalgorithm) to type `long` (or `COSEAlgorithmIdentifier`) since L3 isn't formally...

Related: #2063

It is correct that authenticators SHALL set the RFU bits to zero, but as discussed in https://github.com/w3c/webauthn/issues/2063#issuecomment-2085263218, RPs should not enforce this as that would break those RPs if these...

Current diff compared to PR #1951: https://github.com/w3c/webauthn/pull/2046/files/aca236f39be577276a7ff962badc33ad6f0d41fb..1df325885582da74f580a4276fc171a707fc655d

@ashpil Have you had time to look at this?