PROPOSED: Web Authentication Working Group Charter

The mission of the Web Authentication Working Group is to define a client-side API providing strong authentication functionality to Web Applications.

Join the Web Authentication Working Group.

This proposed charter is available on GitHub. Feel free to raise issues.

Charter Status	PROPOSED
Start date	[dd monthname yyyy] (date of the "Call for Participation", when the charter is approved)
End date	[dd monthname yyyy] (Start date + 2 years)
Chairs	John Fontana, W3C Invited Expert Anthony Nadalin, W3C Invited Expert
Team Contacts	Simone Onofri (0.05 FTE)
Meeting Schedule	Teleconferences: 1-hour calls will be held weekly. Face-to-face: we will meet during the W3C's annual Technical Plenary week; additional face-to-face meetings may be scheduled by consent of the participants, usually no more than 1 per year.

Motivation and Background

The Web Authentication Working Group develops specifications defining an API, as well as signature and attestation formats which provide an asymmetric and symmetric cryptography-based foundation for authentication of users to Web Applications.

Overall goals include obviating the use of shared secrets, i.e. passwords, as authentication credentials, facilitating multi-factor authentication support as well as hardware-based key storage while respecting the Same Origin Policy (SOP) by default and allowing for explicit, constrained SOP relaxation.

Scope

The Working Group will determine use cases that the API needs to support and use these to derive requirements. Success will be determined by the implementation of API features as defined in this section of the charter.

API Features in scope are:

Requesting generation of multiple asymmetric key pairs within a specific scope (e.g., an origin) with crypto (signature and curve) agility and crypto parameter selection;
Proving that the browser has possession of a specific private key, where the proof can only be done within the scope of the key pair. In other words, authentication should obey the same origin policy;
Remote desktop (unattended operation) ability;
Ability to allow a non-modal UI;
Binding of ambient credentials;
Re-authentication from the discretion of the relying party;
Dynamic linking of authentication credentials;
Storing of private key(s);
Account recovery and/or credential backup options;
Facilitate relying party adoption through additional API enhancements such as returning transport indications in assertions, a credential “durability” signal, and credential status feedback signaling from relying parties.

Dependencies may exist on the Credential Management API in the W3C Web Application Security Working Group along with the Client To Authenticator Protocol specification in FIDO.

Note that the details of any user experience (such as prompts) will not be normatively specified, although they may be informatively specified for certain function calls.

The Web Authentication Working Group should aim to produce specifications that have wide deployment and should adopt, refine and when needed, extend, existing practices and community-driven draft specifications when possible. The APIs should work with a wide variety of authenticators and should not require non-standardized vendor-specific infrastructure.

Comprehensive test suites should be developed for the specification to ensure interoperability. User-centric privacy considerations of device management and credentials should be taken into account. The Working Group may produce protocol standards as needed by the API.

Out of Scope

The following features are out of scope, and will not be addressed by this Working group.

federated identity,
multi-origin credentials,
low-level access to cryptographic operations or key material.

Deliverables

Updated document status is available on the group publication status page.

Draft state indicates the state of the deliverable at the time of the charter approval. Expected completion indicates when the deliverable is projected to become a Recommendation, or otherwise reach a stable state.

Normative Specifications

The Working Group will deliver the following W3C normative specifications:

Web Authentication API

This specification makes secure authentication available to Web application developers via a standardized API. This new version will incorporate errata of the earlier Web Authentication Specifications and any additional authenticator selection criteria use cases.

Draft state: Working Draft (Level 3)

Expected completion: Q1 2025

Adopted Draft: Web Authentication: An API for accessing Public Key Credentials Level 3, 27 September 2023

Exclusion Draft: https://www.w3.org/TR/2021/WD-webauthn-3-20210427/
Exclusion period began; Exclusion period ended. Exclusion period began on 2021-04-27 and ended on 2021-09-24.

Exclusion Draft Charter: https://www.w3.org/2019/10/webauthn-wg-charter.html

Other Deliverables

The working group will produce a test suite and implementation report for its specification(s).

Other non-normative documents may be created such as:

Use case and requirement documents, including use cases as needed to inform user requirements across horizontal areas,
Primer or Best Practice documents to support web developers when designing applications.
Protocol design overview documents or flow diagrams.

Success Criteria

In order to advance to Proposed Recommendation, each normative specification is expected to have at least two independent interoperable implementations of every feature defined in the specification, where interoperability can be verified by passing open test suites, and two or more implementations interoperating with each other.

There should be testing plans for each specification, starting from the earliest drafts.

To promote interoperability, all changes made to specifications in Candidate Recommendation or to features that have deployed implementations should have tests. Testing efforts should be conducted via the Web Platform Tests project.

Each specification should contain sections detailing all known security and privacy implications for implementers, Web authors, and end users. The security considerations section must include a comprehensive threat model with threats, attacks, mitigations and residual risks.

Each specification should contain a section on accessibility that describes the benefits and impacts, including ways specification features can be used to address them, and recommendations for maximising accessibility in implementations.

This Working Group expects to follow the TAG Web Platform Design Principles.

Coordination

For all specifications, this Working Group will seek horizontal review for accessibility, internationalization, privacy, and security with the relevant Working and Interest Groups, and with the TAG. Invitation for review must be issued during each major standards-track document transition, including FPWD. The Working Group is encouraged to engage collaboratively with the horizontal review groups throughout development of each specification. The Working Group is advised to seek a review at least 3 months before first entering CR and is encouraged to proactively notify the horizontal review groups when major changes occur in a specification following a review.

The Working Group will establish liaisons with the other standards bodies working on particular authenticators as needed.

Additional technical coordination with the following Groups will be made, per the W3C Process Document:

W3C Groups

Web Application Security Working Group: Coordination with Credential Management API and application security.
Web Applications Working Group: Coordination on API design.
Web Payments Working Group: To liaison over issues related to strong authentication for payments and tokenization.
Web Payments Security Interest Group: To liaison over issues related to strong authentication for payments and tokenization with FIDO, W3C and EMVCo.
Privacy Interest Group: Coordination on privacy implications.
Accessible Platform Architectures (APA) Working Group: Coordination to review accessibility requirements for APIs and for any direct user interfaces that may be specified.
WebAuthn Adoption Community Group: This group helps coordinate research and actions to help with broader adoption of the Web Authentication ecosystem.

External Organizations

IETF Security Area Directorate: The IETF Security Area Directorate consists of the Working Group Chairs of the Security Area and selected individuals chosen for their technical knowledge in security.
FIDO2 Technical Working Group: Coordination on Client to Authenticator Protocol.

Participation

To be successful, this Working Group is expected to have 6 or more active participants for its duration, including representatives from the key implementors of this specification, and active Editors and Test Leads for each specification. The Chairs, specification Editors, and Test Leads are expected to contribute half of a working day per week towards the Working Group. There is no minimum requirement for other Participants.

The group encourages questions, comments and issues on its public mailing lists and document repositories, as described in Communication.

The group also welcomes non-Members to contribute technical submissions for consideration upon their agreement to the terms of the W3C Patent Policy.

Participants in the group are required (by the W3C Process) to follow the W3C Code of Conduct.

Communication

Technical discussions for this Working Group are conducted in public: the meeting minutes from teleconference and face-to-face meetings will be archived for public review, and technical discussions and issue tracking will be conducted in a manner that can be both read and written to by the general public. Working Drafts and Editor's Drafts of specifications will be developed in public repositories and may permit direct public contribution requests. The meetings themselves are not open to public participation, however.

Information about the group (including details about deliverables, issues, actions, status, participants, and meetings) will be available from the Web Authentication Working Group home page.

Most Web Authentication Working Group teleconferences will focus on discussion of particular specifications, and will be conducted on an as-needed basis.

This group primarily conducts its technical work on the public mailing list public-webauthn@w3.org (archive) and on GitHub issues. The public is invited to review, discuss and contribute to this work.

The group may use a Member-confidential mailing list for administrative purposes and, at the discretion of the Chairs and members of the group, for member-only discussions in special cases when a participant requests such a discussion.

Decision Policy

This group will seek to make decisions through consensus and due process, per the W3C Process Document (section 5.2.1, Consensus). Typically, an editor or other participant makes an initial proposal, which is then refined in discussion with members of the group and other reviewers, and consensus emerges with little formal voting being required.

However, if a decision is necessary for timely progress and consensus is not achieved after careful consideration of the range of views presented, the Chairs may call for a group vote and record a decision along with any objections.

To afford asynchronous decisions and organizational deliberation, any resolution (including publication decisions) taken in a face-to-face meeting or teleconference will be considered provisional. A call for consensus (CfC) will be issued for all resolutions (for example, via email, GitHub issue or web-based survey), with a response period from one week to 10 working days, depending on the chair's evaluation of the group consensus on the issue. If no objections are raised by the end of the response period, the resolution will be considered to have consensus as a resolution of the Working Group.

All decisions made by the group should be considered resolved unless and until new information becomes available or unless reopened at the discretion of the Chairs.

This charter is written in accordance with the W3C Process Document (Section 5.2.3, Deciding by Vote) and includes no voting procedures beyond what the Process Document requires.

Patent Policy

This Working Group operates under the W3C Patent Policy (Version of 15 September 2020). To promote the widest adoption of Web standards, W3C seeks to issue Web specifications that can be implemented, according to this policy, on a Royalty-Free basis. For more information about disclosure obligations for this group, please see the licensing information.

Licensing

This Working Group will use the W3C Software and Document license for all its deliverables.

About this Charter

This charter has been created according to section 3.4 of the Process Document. In the event of a conflict between this document or the provisions of any charter and the W3C Process, the W3C Process shall take precedence.

Charter History

The following table lists details of all changes from the initial charter, per the W3C Process Document (section 4.3, Advisory Committee Review of a Charter):

Charter Period	Start Date	End Date	Changes
Initial Charter	8 February 2016	8 February 2017
Charter Extension (Announcement)	8 February 2017	8 August 2017	Samuel Weiler added as team contact. Harry Halpin stepped down as team contact.
New co-chair (Announcement)	no change	no change	John Fontana appointed as chair, 21 June 2017. Richard Barnes stepped down as chair, 22 March 2017.
Charter Extension (Announcement)	8 February 2017	31 October 2017	Charter extended
Rechartered (Announcement)	11 October 2017	15 September 2019	Rechartered to include a version 2.
Recharter	15 October 2021	30 December 2021	Charter extended.
Chair Update	no change	no change	Anthony Nadalin re-appointed as group chair, 7 August 2020.
Rechartered	13 April 2022	13 April 2024	Recharter for level 3, with additional API features added to scope.
Rechartered	TBD	TBD+2	Minor tweaks to scope to sync with coordination section. Switching to Software license for specifications. Drop DiD WG coordination.

Change log

Changes to this document are documented in this section.