Receipt draft

Abstract. A Receipt is an issuer-countersigned record that a specific human, using a WebAuthn credential with user verification, confirmed a specific Statement whose rendered rows are carried inside the receipt. The WebAuthn challenge is the SHA-256 hash of the statement, so the authenticator's signature covers the rendered text without changes to browsers or authenticators. Receipts are verifiable offline with two cached documents (the issuer's key set and its signed revocation list). Issuer signatures are hybrid Ed25519 + ML-DSA-87 (FIPS 204).

1. Ceremony — (1) the RP posts a signed statement; (2) the issuer validates R1–R6 and computes stmt_hash = SHA-256(JCS(statement without rp_sig)); (3) the issuer returns WebAuthn request options with challenge = stmt_hash and userVerification = required; (4) the client displays only render; (5) the issuer verifies the assertion (type, challenge equality, origin, rpIdHash, UP, UV, counter, signature) and records the dwell time and AAGUID.
2. Receipt v2 — members and constraints as in Receipt reference. presence.tier MUST be derived from what ran (UV flag, AAGUID attachment per the FIDO Metadata Service); an unknown authenticator is P2, never higher.
3. Signature — M = "manav-receipt/2" || 0x0A || JCS(receipt without sig); sig = {ed25519, mldsa87}; verifiers MUST check both and MUST reject when either is absent or invalid, with distinct reject codes (bad_signature, pq_signature_missing, pq_signature_invalid). ML-DSA in pure mode, empty context.
4. Key publication — JWKS with OKP/Ed25519 and AKP/ML-DSA-87 entries paired by kid and kid.pq.
5. Revocation — v1 list (kids, nonces; Ed25519; legacy canonical) and v2 list (manav-revocation/2; hybrid; strictly increasing seq; re-signed at least every 300 s). A verifier without a verifiable list MUST reject.
6. Verification algorithm — Receipt reference §"Verifier algorithm"; conformance vectors in tests/vectors/receipts.
7. Security considerations — the receipt proves that a UV credential holder signed the hash of the statement the issuer served; it does not prove the host's display was uncompromised (tiers P1–P3 share this limit; P4 requires a trusted display). It does not prove comprehension, absence of coercion or uniqueness. Post-quantum protection is placed on the long-lived issuer signature; the passkey assertion is classical, its public key is never published, and the hybrid countersignature fixes it in time.