Zdravo TAG!

I'm requesting a TAG review of Browser Bound Keys, a change to Secure Payment Confirmation (802, 763, 675, 544).

Add device-binding-like capabilities, in the form of browser bound keys (BBKs), to Secure Payment Confirmation without relying on WebAuthn (at either the client or authenticator level)

• Explainer¹: Proposal: WebAuthn-agnostic browser binding for Secure Payment Confirmation w3c/secure-payment-confirmation#271
• Specification: Add browser binding to the secure payment confirmation spec w3c/secure-payment-confirmation#286, [Spec] Add browser bound keys privacy and security considerations. w3c/secure-payment-confirmation#296
• WPT Tests: feasibility depends on whether user agents are permitted to support “software” keys
• User research: none
• Security and Privacy self-review²: https://github.com/w3c/secure-payment-confirmation/blob/main/security-privacy-questionnaire-bbk.md
• GitHub repo: https://github.com/w3c/secure-payment-confirmation
• Primary contacts:
  • Slobodan Pejic (@pejic), Google, Spec Change Editor & Implementor
  • Stephen McGruer (@stephenmcgruer), Google, Spec Editor
• Organization/project driving the specification: Chromium
• This work is being funded by: Google
• Primary standards group developing this feature: Web Payments Working Group
• Group intended to standardize this work:
• Incubation and standards groups that have discussed the design:
  • Web Payments Working Group: E.g. 2025-04-24 Minutes, 2025-05-08 Minutes
• Multi-stakeholder support³:
  • Chromium comments:
  • Mozilla comments: Secure Payment Confirmation mozilla/standards-positions#570
  • WebKit comments: Secure Payment Confirmation (SPC) WebKit/standards-positions#30
• Major unresolved issues with or opposition to this specification:
  • “Software” key support: Specify storage type hint for browser bound keys w3c/secure-payment-confirmation#288
  • Whether key storage attestation would be included: 2024-10-10 Minutes
• Status/issue trackers for implementations⁴: https://chromestatus.com/feature/5106102997614592

Further details:

• I have reviewed the TAG's Web Platform Design Principles
• Previous early design review, if any:
  • None for browser bound keys. See above for Secure Payment Confirmation reviews.
• Relevant time constraints or deadlines: