diff --git a/index.bs b/index.bs index 0e61497b8..82cbea2e9 100644 --- a/index.bs +++ b/index.bs @@ -4758,6 +4758,14 @@ the requested [=public key credential|credential=] is [=scoped=] to exactly matc possibly combined in a single [=authorization gesture=], then the authenticator will set both the [=UP=] [=flag=] and the [=authData/flags/UV=] [=flag=]. +- The [=BE=] [=flag=] SHALL be set if and only if the credential is a [=multi-device credential=]. + This value MUST NOT change after a [=registration ceremony=] as defined in [[#sctn-credential-backup]]. + +- The [=BS=] [=flag=] SHALL be set if and only if the credential is a [=multi-device credential=] and is currently [=backed up=]. + + If the backup status of a credential is uncertain or the authenticator suspects a problem with the backed up credential, + the [=BS=] [=flag=] SHOULD NOT be set. + - For [=attestation signatures=], the authenticator MUST set the [=AT=] [=flag=] and include the [=attestedCredentialData=]. For [=assertion signatures=], the [=AT=] [=flag=] MUST NOT be set and the [=attestedCredentialData=] MUST NOT be included.