FIDO Attestation and Metadata Flashcards

What is the primary purpose of attestation in FIDO2/WebAuthn?

Answer: To prove the authenticity and integrity of an authenticator to a relying party

Attestation allows a relying party to cryptographically verify that the authenticator is genuine and was manufactured by a trusted vendor.

Which of the following is NOT a standard attestation statement format defined in WebAuthn?

Answer: OAuth attestation

WebAuthn defines packed, TPM, Android Key, Android SafetyNet, FIDO U2F, and none formats — OAuth is an authorization protocol, not a WebAuthn attestation format.

What does the FIDO Metadata Service (MDS) primarily provide to relying parties?

Answer: Metadata statements describing authenticator properties, certifications, and trust anchors

The FIDO MDS provides metadata statements that describe authenticator capabilities, certification level, and the root certificates needed to verify attestation signatures.

What is a WebAuthn attestation statement?

Answer: A data structure signed by the authenticator proving its identity and the binding of the new credential

An attestation statement is produced by the authenticator during credential creation and contains a signature over the authenticator data, proving the credential's origin.

What does 'none' attestation convey in WebAuthn?

Answer: No attestation information is provided, making it impossible to verify the authenticator's origin

The 'none' attestation format means the authenticator provides no statement about its provenance, so the relying party cannot determine what kind of authenticator was used.

What role does an Attestation Certificate Authority (CA) play in FIDO?

Answer: It signs attestation certificates embedded in authenticators, forming the root of a verifiable trust chain

An Attestation CA issues certificates to authenticator manufacturers that are embedded in devices, creating the chain of trust relying parties use to verify authenticator genuineness.

Which of the following fields is typically found in a FIDO Metadata Statement?

Answer: Authenticator AAGUID, supported cryptographic algorithms, and attestation root certificates

A metadata statement contains the authenticator's AAGUID, supported COSE algorithm identifiers, certification status, and the root certificates required to verify that authenticator's attestation.