webauthn icon indicating copy to clipboard operation
webauthn copied to clipboard

Conditional creation incompatible with `uvInitialized` semantics in Chapter 7?

Open arianvp opened this issue 5 months ago • 6 comments

https://w3c.github.io/webauthn/#sctn-createCredential says

The client MUST set BOTH requireUserPresence and requireUserVerification to FALSE when options.mediation is set to conditional unless they may explicitly performed during the ceremony.

However then that means that uvInitialized is set to FALSE in the credential record according to https://w3c.github.io/webauthn/#reg-ceremony-create-credential-record

which means that the credential created may not be used for authentication

When this is false, including an authentication ceremony where it would be updated to true, the UV flag MUST NOT be relied upon as an authentication factor.

https://w3c.github.io/webauthn/#abstract-opdef-credential-record-uvinitialized

This feels like it is in contradiction with each-other. The whole idea of conditional creation is that we automatically create a passkey for subsequent log ins. However this is incompatible with the uvInitialized semantics from my reading?

arianvp avatar May 14 '25 17:05 arianvp