Skip to content

Commit faee219

Browse files
emlunemlun
authored
Merge pull request #994 from w3c/issue-990-table-captions
Add table numbers and captions
2 parents bf4dbab + bc15894 commit faee219

File tree

1 file changed

+179
-150
lines changed

1 file changed

+179
-150
lines changed

‎index.bs‎

Lines changed: 179 additions & 150 deletions
Original file line numberDiff line numberDiff line change
@@ -67,6 +67,25 @@ Boilerplate: omit conformance, omit feedback-header, omit abstract-header
6767
Markup Shorthands: css off, markdown on
6868
</pre>
6969

70+
<style type="text/css">
71+
body {
72+
counter-reset: table;
73+
}
74+
/* For some reason, doing the counter-increment on the figcaption like Bikeshed does with figures does not seem to work here. */
75+
figure.table {
76+
counter-increment: table;
77+
}
78+
figure.table figcaption {
79+
counter-increment: none;
80+
}
81+
figure.table figcaption:not(.no-marker)::before {
82+
content: "Table " counter(table) " ";
83+
}
84+
figure.table .overlarge {
85+
max-width: 50em;
86+
}
87+
</style>
88+
7089

7190
<!-- TODO: Clean out these anchor lists once they appear in Shepherd -->
7291
<pre class="anchors">
@@ -2355,67 +2374,69 @@ format, and uses its knowledge of the authenticator to make trust decisions.
23552374
The [=authenticator data=] has a compact but extensible encoding. This is desired since authenticators can be devices with
23562375
limited capabilities and low power requirements, with much simpler software stacks than the client platform components.
23572376

2358-
The [=authenticator data=] structure is a byte array of 37 bytes or more, as follows.
2359-
2360-
<table class="complex data longlastcol">
2361-
<tr>
2362-
<th>Name</th>
2363-
<th>Length (in bytes)</th>
2364-
<th>Description</th>
2365-
</tr>
2366-
<tr>
2367-
<td><dfn>rpIdHash</dfn></td>
2368-
<td>32</td>
2369-
<td>
2370-
SHA-256 hash of the [=RP ID=] associated with the credential.
2371-
</td>
2372-
</tr>
2373-
<tr>
2374-
<td><dfn>flags</dfn></td>
2375-
<td>1</td>
2376-
<td>
2377-
Flags (bit 0 is the least significant bit):
2378-
- Bit 0: [=User Present=] ([=UP=]) result.
2379-
- `1` means the user is [=user present|present=].
2380-
- `0` means the user is not [=user present|present=].
2381-
- Bit 1: Reserved for future use (`RFU1`).
2382-
- Bit 2: [=User Verified=] ([=UV=]) result.
2383-
- `1` means the user is [=user verified|verified=].
2384-
- `0` means the user is not [=user verified|verified=].
2385-
- Bits 3-5: Reserved for future use (`RFU2`).
2386-
- Bit 6: [=Attested credential data=] included (`AT`).
2387-
- Indicates whether the authenticator added [=attested credential data=].
2388-
- Bit 7: Extension data included (`ED`).
2389-
- Indicates if the [=authenticator data=] has [=authDataExtensions|extensions=].
2390-
</td>
2391-
</tr>
2392-
<tr>
2393-
<td><dfn>signCount</dfn></td>
2394-
<td>4</td>
2395-
<td>[=Signature counter=], 32-bit unsigned big-endian integer.</td>
2396-
</tr>
2397-
<tr>
2398-
<td><dfn>attestedCredentialData</dfn></td>
2399-
<td>variable (if present)</td>
2400-
<td>
2401-
[=attested credential data=] (if present). See [[#sec-attested-credential-data]] for details. Its length depends on
2402-
the [=credentialIdLength|length=] of the [=credentialId|credential ID=] and [=credentialPublicKey|credential public
2403-
key=] being attested.
2404-
</td>
2405-
</tr>
2406-
<tr>
2407-
<td><dfn lt="authDataExtensions">extensions</dfn></td>
2408-
<td>variable (if present)</td>
2409-
<td>
2410-
Extension-defined [=authenticator data=]. This is a [=CBOR=] [[RFC7049]] map with [=extension identifiers=] as keys,
2411-
and [=authenticator extension outputs=] as values. See [[#extensions]] for details.
2412-
</td>
2413-
</tr>
2414-
</table>
2415-
2416-
NOTE: The names in the Name column in the above table are only for reference within this document, and are not present in the
2417-
actual representation of the [=authenticator data=].
2377+
The [=authenticator data=] structure is a byte array of 37 bytes or more, laid out as shown in [Table 1](#table-authData).
24182378

2379+
<figure id="table-authData" class="table">
2380+
<table class="complex data longlastcol">
2381+
<tr>
2382+
<th>Name</th>
2383+
<th>Length (in bytes)</th>
2384+
<th>Description</th>
2385+
</tr>
2386+
<tr>
2387+
<td><dfn>rpIdHash</dfn></td>
2388+
<td>32</td>
2389+
<td>
2390+
SHA-256 hash of the [=RP ID=] associated with the credential.
2391+
</td>
2392+
</tr>
2393+
<tr>
2394+
<td><dfn>flags</dfn></td>
2395+
<td>1</td>
2396+
<td>
2397+
Flags (bit 0 is the least significant bit):
2398+
- Bit 0: [=User Present=] ([=UP=]) result.
2399+
- `1` means the user is [=user present|present=].
2400+
- `0` means the user is not [=user present|present=].
2401+
- Bit 1: Reserved for future use (`RFU1`).
2402+
- Bit 2: [=User Verified=] ([=UV=]) result.
2403+
- `1` means the user is [=user verified|verified=].
2404+
- `0` means the user is not [=user verified|verified=].
2405+
- Bits 3-5: Reserved for future use (`RFU2`).
2406+
- Bit 6: [=Attested credential data=] included (`AT`).
2407+
- Indicates whether the authenticator added [=attested credential data=].
2408+
- Bit 7: Extension data included (`ED`).
2409+
- Indicates if the [=authenticator data=] has [=authDataExtensions|extensions=].
2410+
</td>
2411+
</tr>
2412+
<tr>
2413+
<td><dfn>signCount</dfn></td>
2414+
<td>4</td>
2415+
<td>[=Signature counter=], 32-bit unsigned big-endian integer.</td>
2416+
</tr>
2417+
<tr>
2418+
<td><dfn>attestedCredentialData</dfn></td>
2419+
<td>variable (if present)</td>
2420+
<td>
2421+
[=attested credential data=] (if present). See [[#sec-attested-credential-data]] for details. Its length depends on
2422+
the [=credentialIdLength|length=] of the [=credentialId|credential ID=] and [=credentialPublicKey|credential public
2423+
key=] being attested.
2424+
</td>
2425+
</tr>
2426+
<tr>
2427+
<td><dfn lt="authDataExtensions">extensions</dfn></td>
2428+
<td>variable (if present)</td>
2429+
<td>
2430+
Extension-defined [=authenticator data=]. This is a [=CBOR=] [[RFC7049]] map with [=extension identifiers=] as keys,
2431+
and [=authenticator extension outputs=] as values. See [[#extensions]] for details.
2432+
</td>
2433+
</tr>
2434+
</table>
2435+
<figcaption>
2436+
[=Authenticator data=] layout. The names in the Name column are only for reference within this document, and are not
2437+
present in the actual representation of the [=authenticator data=].
2438+
</figcaption>
2439+
</figure>
24192440

24202441
The [=RP ID=] is originally received from the client when the credential is created, and again when an assertion is generated.
24212442
However, it differs from other [=client data=] in some important ways. First, unlike the client data, the [=RP ID=] of a
@@ -2491,56 +2512,61 @@ the same procedure as other [=assertion signatures=] generated by the [=authenti
24912512
[=Authenticator=] types vary along several different dimensions: [=authenticator attachment modality=], employed [[#transport|transport(s)]],
24922513
[=credential storage modality=], and [=authentication factor capability=]. The combination of these dimensions defines an
24932514
[=authenticator=]'s <dfn>authenticator type</dfn>, which in turn determines the broad use cases the [=authenticator=] supports.
2494-
The following defines names for some [=authenticator types=]:
2495-
2496-
<table class="data">
2497-
<thead>
2498-
<tr>
2499-
<th> [=Authenticator Type=] </th>
2500-
<th> [=Authenticator Attachment Modality=] </th>
2501-
<th> [=Credential Storage Modality=] </th>
2502-
<th> [=Authentication Factor Capability=] </th>
2503-
</tr>
2504-
</thead>
2505-
<tbody>
2506-
<tr>
2507-
<th> <dfn>Second-factor platform authenticator</dfn> </th>
2508-
<td> [=platform attachment|platform=] </td>
2509-
<td> [=remote credential storage modality|Remote=] </td>
2510-
<td> [=single-factor capable|Single-factor=] </td>
2511-
</tr>
2512-
<tr>
2513-
<th> <dfn>User-verifying platform authenticator</dfn> </th>
2514-
<td> [=platform attachment|platform=] </td>
2515-
<td> [=remote credential storage modality|Remote=] </td>
2516-
<td> [=multi-factor capable|Multi-factor=] </td>
2517-
</tr>
2518-
<tr>
2519-
<th> <dfn>First-factor platform authenticator</dfn> </th>
2520-
<td> [=platform attachment|platform=] </td>
2521-
<td> [=local credential storage modality|Local=] </td>
2522-
<td> [=multi-factor capable|Multi-factor=] </td>
2523-
</tr>
2524-
<tr>
2525-
<th> <dfn>Second-factor roaming authenticator</dfn> </th>
2526-
<td> [=cross-platform attachment|cross-platform=] </td>
2527-
<td> [=remote credential storage modality|Remote=] </td>
2528-
<td> [=single-factor capable|Single-factor=] </td>
2529-
</tr>
2530-
<tr>
2531-
<th> <dfn>User-verifying roaming authenticator</dfn> </th>
2532-
<td> [=cross-platform attachment|cross-platform=] </td>
2533-
<td> [=remote credential storage modality|Remote=] </td>
2534-
<td> [=multi-factor capable|Multi-factor=] </td>
2535-
</tr>
2536-
<tr>
2537-
<th> <dfn>First-factor roaming authenticator</dfn> </th>
2538-
<td> [=cross-platform attachment|cross-platform=] </td>
2539-
<td> [=local credential storage modality|Local=] </td>
2540-
<td> [=multi-factor capable|Multi-factor=] </td>
2541-
</tr>
2542-
</tbody>
2543-
</table>
2515+
[Table 2](#table-authenticatorTypes) defines names for some [=authenticator types=].
2516+
2517+
<figure id="table-authenticatorTypes" class="table">
2518+
<table class="data">
2519+
<thead>
2520+
<tr>
2521+
<th> [=Authenticator Type=] </th>
2522+
<th> [=Authenticator Attachment Modality=] </th>
2523+
<th> [=Credential Storage Modality=] </th>
2524+
<th> [=Authentication Factor Capability=] </th>
2525+
</tr>
2526+
</thead>
2527+
<tbody>
2528+
<tr>
2529+
<th> <dfn>Second-factor platform authenticator</dfn> </th>
2530+
<td> [=platform attachment|platform=] </td>
2531+
<td> [=remote credential storage modality|Remote=] </td>
2532+
<td> [=single-factor capable|Single-factor=] </td>
2533+
</tr>
2534+
<tr>
2535+
<th> <dfn>User-verifying platform authenticator</dfn> </th>
2536+
<td> [=platform attachment|platform=] </td>
2537+
<td> [=remote credential storage modality|Remote=] </td>
2538+
<td> [=multi-factor capable|Multi-factor=] </td>
2539+
</tr>
2540+
<tr>
2541+
<th> <dfn>First-factor platform authenticator</dfn> </th>
2542+
<td> [=platform attachment|platform=] </td>
2543+
<td> [=local credential storage modality|Local=] </td>
2544+
<td> [=multi-factor capable|Multi-factor=] </td>
2545+
</tr>
2546+
<tr>
2547+
<th> <dfn>Second-factor roaming authenticator</dfn> </th>
2548+
<td> [=cross-platform attachment|cross-platform=] </td>
2549+
<td> [=remote credential storage modality|Remote=] </td>
2550+
<td> [=single-factor capable|Single-factor=] </td>
2551+
</tr>
2552+
<tr>
2553+
<th> <dfn>User-verifying roaming authenticator</dfn> </th>
2554+
<td> [=cross-platform attachment|cross-platform=] </td>
2555+
<td> [=remote credential storage modality|Remote=] </td>
2556+
<td> [=multi-factor capable|Multi-factor=] </td>
2557+
</tr>
2558+
<tr>
2559+
<th> <dfn>First-factor roaming authenticator</dfn> </th>
2560+
<td> [=cross-platform attachment|cross-platform=] </td>
2561+
<td> [=local credential storage modality|Local=] </td>
2562+
<td> [=multi-factor capable|Multi-factor=] </td>
2563+
</tr>
2564+
</tbody>
2565+
</table>
2566+
<figcaption>
2567+
Definitions of names for some [=authenticator types=].
2568+
</figcaption>
2569+
</figure>
25442570

25452571
These types can be further broken down into subtypes, such as which [[#transport|transport(s)]] a [=roaming authenticator=]
25462572
supports. The following sections define the terms [=authenticator attachment modality=], [=credential storage modality=] and
@@ -2953,46 +2979,49 @@ understand the characteristics of the [=authenticators=] that they trust, based
29532979
### Attested credential data ### {#sec-attested-credential-data}
29542980

29552981
<dfn>Attested credential data</dfn> is a variable-length byte array added to the [=authenticator data=] when generating an [=attestation
2956-
object=] for a given credential. It has the following format:
2957-
2958-
<table class="complex data longlastcol">
2959-
<tr>
2960-
<th>Name</th>
2961-
<th>Length (in bytes)</th>
2962-
<th>Description</th>
2963-
</tr>
2964-
<tr>
2965-
<td><dfn>aaguid</dfn></td>
2966-
<td>16</td>
2967-
<td>The AAGUID of the authenticator.</td>
2968-
</tr>
2969-
<tr>
2970-
<td><dfn>credentialIdLength</dfn></td>
2971-
<td>2</td>
2972-
<td>Byte length <strong>L</strong> of Credential ID, 16-bit unsigned big-endian integer.</td>
2973-
</tr>
2974-
<tr>
2975-
<td><dfn>credentialId</dfn></td>
2976-
<td>L</td>
2977-
<td>[=Credential ID=]</td>
2978-
</tr>
2979-
<tr>
2980-
<td><dfn>credentialPublicKey</dfn></td>
2981-
<td>variable</td>
2982-
<td>
2983-
The [=credential public key=] encoded in COSE_Key format,
2984-
as defined in [=Section 7=] of [[RFC8152]], using the [=CTAP2 canonical CBOR encoding form=].
2985-
The COSE_Key-encoded [=credential public key=] MUST contain the "alg" parameter and MUST NOT
2986-
contain any other OPTIONAL parameters. The "alg" parameter MUST contain a {{COSEAlgorithmIdentifier}} value.
2987-
The encoded [=credential public key=] MUST also contain any additional REQUIRED parameters stipulated by the
2988-
relevant key type specification, i.e., REQUIRED for the key type "kty" and algorithm "alg" (see Section 8 of
2989-
[[RFC8152]]).
2990-
</td>
2991-
</tr>
2992-
</table>
2993-
2994-
NOTE: The names in the Name column in the above table are only for reference within this document, and are not present in the
2995-
actual representation of the [=attested credential data=].
2982+
object=] for a given credential. Its format is shown in [Table 3](#table-attestedCredentialData).
2983+
2984+
<figure id="table-attestedCredentialData" class="table">
2985+
<table class="complex data longlastcol">
2986+
<tr>
2987+
<th>Name</th>
2988+
<th>Length (in bytes)</th>
2989+
<th>Description</th>
2990+
</tr>
2991+
<tr>
2992+
<td><dfn>aaguid</dfn></td>
2993+
<td>16</td>
2994+
<td>The AAGUID of the authenticator.</td>
2995+
</tr>
2996+
<tr>
2997+
<td><dfn>credentialIdLength</dfn></td>
2998+
<td>2</td>
2999+
<td>Byte length <strong>L</strong> of Credential ID, 16-bit unsigned big-endian integer.</td>
3000+
</tr>
3001+
<tr>
3002+
<td><dfn>credentialId</dfn></td>
3003+
<td>L</td>
3004+
<td>[=Credential ID=]</td>
3005+
</tr>
3006+
<tr>
3007+
<td><dfn>credentialPublicKey</dfn></td>
3008+
<td>variable</td>
3009+
<td>
3010+
The [=credential public key=] encoded in COSE_Key format,
3011+
as defined in [=Section 7=] of [[RFC8152]], using the [=CTAP2 canonical CBOR encoding form=].
3012+
The COSE_Key-encoded [=credential public key=] MUST contain the "alg" parameter and MUST NOT
3013+
contain any other OPTIONAL parameters. The "alg" parameter MUST contain a {{COSEAlgorithmIdentifier}} value.
3014+
The encoded [=credential public key=] MUST also contain any additional REQUIRED parameters stipulated by the
3015+
relevant key type specification, i.e., REQUIRED for the key type "kty" and algorithm "alg" (see Section 8 of
3016+
[[RFC8152]]).
3017+
</td>
3018+
</tr>
3019+
</table>
3020+
<figcaption>
3021+
[=Attested credential data=] layout. The names in the Name column are only for reference within this document, and are not
3022+
present in the actual representation of the [=attested credential data=].
3023+
</figcaption>
3024+
</figure>
29963025

29973026
#### Examples of `credentialPublicKey` Values encoded in COSE_Key format #### {#sctn-encoded-credPubKey-examples}
29983027

0 commit comments

Comments
 (0)