Improved version of extension for Transaction Confirmation

index.bs

@@ -7532,7 +7532,7 @@ See also [[#sctn-supplemental-public-keys-extension-usage]] for further details.
 ##### Authentication (`get()`) ##### {#sctn-supplemental-public-keys-extension-verification-get}
 
 If the [=[RP]=] requested the `supplementalPubKeys` extension in a {{CredentialsContainer/get()|navigator.credentials.get()}} call,
-then the below verification steps are performed in the context of [step 17](#authn-ceremony-verify-extension-outputs)
+then the below verification steps are performed in the context of [step 19](#authn-ceremony-verify-extension-outputs)
 of [[#sctn-verifying-assertion]] using these variables established therein: |credential|, |clientExtensionResults|, |authData|, |hash|, and |credentialRecord|.
 [=[RP]=] policy may specify whether a response without a `supplementalPubKeys` extension output is acceptable.
 
@@ -7652,6 +7652,121 @@ To <dfn abstract-op>Create a new supplemental public key record</dfn>, perform t
         [=set/append=] this [=supplemental public key record=] to |credentialRecord|.[$credential record/supplementalPubKeys$].
 
 
+### Confirmation Extension (confirmation) ### {#sctn-simple-txauth-extension}
+
+This extension allows for capturing user confirmation. A
+   [=[RP]=] can specify a confirmation prompt string, intended for display by the platform and by the authenticator (if supported).
+   With this approach, [=Relying Parties=] can use the feature independently of the capabilities of the authenticator used by the user,
+   while still benefitting from the increased security level if the authenticator itself supports showing the confirmation prompt.
+
+Authenticators could use a Trusted UI to ensure that the user indeed sees the confirmation prompt.
+
+Example uses cases could be "I want to move $1234 from account A to account B" or "I want to share my health data with hospital X".
+
+: Extension identifier
+:: `confirmation`
+
+: Operation applicability
+:: [=authentication extension|Authentication=]
+
+: Client extension input
+:: A single USVString confirmationPrompt.
+    <xmp class="idl">
+    partial dictionary AuthenticationExtensionsClientInputs {
+      USVString confirmationPrompt;
+    };
+    </xmp>
+
+: Client extension processing
+:: If this extension is present, the client SHALL
+       1. use a dialog to the user that makes the user aware of the confirmation to be provided (as opposed to doing a simple sign in).
+       1. display the confirmation prompt to the user. The client SHOULD
+             indicate that the confirmation prompt originates from a specific relying party
+             (as opposed to the platform itself).
+
+       1. use the {{CollectedClientConfirmationData}} structure containing the confirmation prompt instead of using
+             the {{CollectedClientData}} structure.
+
+       1. pass-through the extension to the authenticator (see "client extension output" below)
+       1. pass-through the "authenticator extension output" to the caller as part of the assertion
+
+
+    <xmp class="idl">
+        dictionary CollectedClientConfirmationData : CollectedClientData {
+            required CollectedClientAdditionalConfirmationData confirmationPrompt;
+        };
+    </xmp>
+
+    The {{CollectedClientConfirmationData}} dictionary inherits from
+    {{CollectedClientData}}. It contains the following additional field:
+
+    <dl dfn-type="dict-member" dfn-for="CollectedClientConfirmationData">
+        :  <dfn>confirmationPrompt</dfn> member
+        :: The full context of the confirmation to give.
+    </dl>
+
+
+    <xmp class="idl">
+        dictionary CollectedClientAdditionalConfirmationData {
+            required USVString confirmationPrompt;
+        };
+    </xmp>
+
+    The {{CollectedClientAdditionalConfirmationData}} dictionary contains the following
+    fields:
+
+    <dl dfn-type="dict-member" dfn-for="CollectedClientAdditionalConfirmationData">
+        :  <dfn>confirmationPrompt</dfn> member
+        :: The full context of the confirmation to give.
+    </dl>
+
+: Client extension output
+:: Returns the authenticator extension output string UTF-8 decoded into a USVString.
+    <xmp class="idl">
+    partial dictionary AuthenticationExtensionsClientOutputs {
+      USVString confirmationPrompt;
+    };
+    </xmp>
+
+: Authenticator extension input
+:: The client provides the extension input encoded as a CBOR text string (major type 3).
+
+<pre>
+CDDL:
+confirmatonPromptInput = (tstr)
+</pre>
+
+: Authenticator extension processing
+:: The authenticator supporting this extension MUST display the confirmation prompt to the user
+    before performing either [=user verification=] or [=test of user
+    presence=]. The authenticator MAY wrap lines that are too wide to be shown if needed.
+
+: Authenticator extension output
+:: If the authenticator supports this extension (and only then): A single CBOR string, representing the
+    confirmation prompt.
+
+<pre>
+CDDL:
+confirmationPromptOutput = (tstr)
+</pre>
+
+#### `confirmation` Extension Output Verification Procedures #### {#sctn-txauthsimple-extension-verification}
+
+Verifying the <code>[=txAuthSimple=]</code> extension output is performed by the [=[RP]=] whenever a the use of <code>[=confirmatione=]</code> was requested.
+
+##### Authentication (`get()`) ##### {#sctn-txauthsimple-extension-verification-get}
+
+This extension is only specified to be used in conjunction with a {{CredentialsContainer/get()|navigator.credentials.get()}} call.
+
+If the [=[RP]=] requested the `confirmation` extension in a {{CredentialsContainer/get()|navigator.credentials.get()}} call, then the below verification step are performed in the context of [step 19](#authn-ceremony-verify-extension-outputs)
+of [[#sctn-verifying-assertion]] using these variables established therein: |credential|, |clientExtensionResults|, |authData|, |hash|, and |credentialRecord|.
+[=[RP]=] policy may specify whether a response without a `confirmation` extension output is acceptable.
+
+1. Verify that the {{AuthenticationExtensionsClientOutputs/confirmation}} member of |clientExtensionResults| exists.
+1. Verify that the {{AuthenticationExtensionsClientOutputs/confirmation}} member contains the confirmation prompt that is expected (i.e., that was used when requesting the `confirmation` extension.
+
+
+
 # User Agent Automation # {#sctn-automation}
 
 For the purposes of user agent automation and [=web application=] testing, this document defines a number of [[WebDriver]] [=extension commands=].
@@ -9256,6 +9371,22 @@ for their contributions as our W3C Team Contacts.
     "date": "June 2019"
   },
 
+  "RFC9052": {
+    "authors": ["Jim Schaad"],
+    "title": "CBOR Object Signing and Encryption (COSE): Structures and Process",
+    "href": "https://datatracker.ietf.org/doc/rfc9052/",
+    "status": "IETF Internet Standard",
+    "date": "August 2022"
+  },
+
+  "RFC9053": {
+    "authors": ["Jim Schaad"],
+    "title": "CBOR Object Signing and Encryption (COSE): Initial Algorithms",
+    "href": "https://datatracker.ietf.org/doc/rfc9053/",
+    "status": "RFC Informational",
+    "date": "August 2022"
+  },
+
   "ISOBiometricVocabulary": {
     "authors": ["ISO/IEC JTC1/SC37"],
     "title": "Information technology — Vocabulary — Biometrics",