New Authenticator Extension: Time Since UV

[timcappalli]

Proposed Change

As discussed on multiple working group calls, this would be an alternative approach to address the user verification caching concerns raised by passkey providers and relying parties.

This approach does not change the meaning or operation of user verification and authenticators would still be required to respond truthfully about UV at the time of the ceremony.

This extension, tentatively identified as timeSinceUv, will allow an authenticator to include the time since UV was performed. The value is expressed in milliseconds for consistency with the rest of the spec.

Relying Parties who want the UX benefits of UV preferred, but would like additional context for post-authentication business logic can request the extension.

Example

Request UV = preferred Extensions = [ timeSinceUv ]

Authenticator State User verification was performed 5 minutes ago

Response UV = false Extension.timeSinceUv = timeSinceUv: 300000