FIDO Attestation and Metadata Flashcards

What is an AAGUID in the context of FIDO2 authenticators?

Answer: An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model

The AAGUID is a 128-bit identifier that uniquely identifies a specific model of authenticator, allowing relying parties to look up the corresponding metadata statement.

Which attestation type provides a certificate chain rooted in the authenticator manufacturer's attestation CA, with each device holding a unique attestation key?

Answer: Basic attestation

Basic attestation gives each authenticator device a unique attestation key pair signed by the manufacturer's CA, enabling a full PKI trust chain up to a known root.

What is 'self attestation' (also called surrogate attestation) in WebAuthn?

Answer: The authenticator signs the attestation using the credential private key itself, providing no independent trust anchor

Self attestation occurs when the authenticator uses the newly created credential key to sign the attestation, offering no independent way for a relying party to verify the authenticator's make or model.

What key improvement does FIDO MDS version 3 (MDS3) introduce compared to MDS2?

Answer: It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling

MDS3 distributes metadata as a signed JWT blob, providing better revocation support, a more structured format, and a more scalable distribution mechanism than MDS2's individual JSON files.

When a relying party sets the attestation conveyance preference to 'direct,' what is the expected behavior?

Answer: The client returns the authenticator's raw attestation statement directly to the relying party for verification

The 'direct' conveyance preference instructs the browser and authenticator to provide the raw attestation statement to the relying party so it can perform its own verification.

What is Enterprise Attestation in FIDO2, and what does it enable?

Answer: A feature that allows enterprises to obtain unique, device-identifiable attestation statements for fleet management

Enterprise Attestation allows organizations to configure authenticators to return unique attestation signatures per device, enabling IT departments to track and manage individual devices at the cost of reduced user anonymity.

What is the purpose of the 'fmt' field in a WebAuthn attestation object?

Answer: It identifies the attestation statement format so the relying party knows how to parse and verify it

The 'fmt' field names the attestation statement format (e.g., 'packed', 'tpm', 'fido-u2f'), which the relying party uses to select the correct verification algorithm and parser.