FCP FIDO Attestation and Metadata 1 — Questions and Answers
Question 1: What is the primary purpose of attestation in FIDO2/WebAuthn?
- To verify the identity of the user during login
- To prove the authenticity and integrity of an authenticator to a relying party (Correct answer)
- To encrypt the public key during credential registration
- To validate the relying party's domain against a whitelist
Correct answer: To prove the authenticity and integrity of an authenticator to a relying party
Attestation allows a relying party to cryptographically verify that the authenticator is genuine and was manufactured by a trusted vendor.
Question 2: Which of the following is NOT a standard attestation statement format defined in WebAuthn?
- Packed attestation
- TPM attestation
- FIDO U2F attestation
- OAuth attestation (Correct answer)
Correct answer: OAuth attestation
WebAuthn defines packed, TPM, Android Key, Android SafetyNet, FIDO U2F, and none formats — OAuth is an authorization protocol, not a WebAuthn attestation format.
Question 3: What does the FIDO Metadata Service (MDS) primarily provide to relying parties?
- A directory of registered FIDO relying parties and their policies
- Metadata statements describing authenticator properties, certifications, and trust anchors (Correct answer)
- Real-time credential revocation status for individual user accounts
- A certificate revocation list for compromised user identities
Correct answer: Metadata statements describing authenticator properties, certifications, and trust anchors
The FIDO MDS provides metadata statements that describe authenticator capabilities, certification level, and the root certificates needed to verify attestation signatures.
Question 4: What is a WebAuthn attestation statement?
- A cryptographic signature from the relying party server confirming successful registration
- A data structure signed by the authenticator proving its identity and the binding of the new credential (Correct answer)
- A user consent record stored in the authenticator's secure enclave after registration
- A JSON Web Token issued by the FIDO Alliance after successful certification
Correct answer: A data structure signed by the authenticator proving its identity and the binding of the new credential
An attestation statement is produced by the authenticator during credential creation and contains a signature over the authenticator data, proving the credential's origin.
Question 5: What does 'none' attestation convey in WebAuthn?
- An error state indicating the authenticator failed its self-test before attesting
- No attestation information is provided, making it impossible to verify the authenticator's origin (Correct answer)
- A deprecated format that has been replaced by packed attestation in modern deployments
- An attestation type reserved exclusively for platform authenticators built into devices
Correct answer: No attestation information is provided, making it impossible to verify the authenticator's origin
The 'none' attestation format means the authenticator provides no statement about its provenance, so the relying party cannot determine what kind of authenticator was used.
Question 6: What role does an Attestation Certificate Authority (CA) play in FIDO?
- It issues TLS certificates for FIDO relying parties to authenticate to users
- It signs attestation certificates embedded in authenticators, forming the root of a verifiable trust chain (Correct answer)
- It manages the lifecycle of individual user credentials stored in cloud HSMs
- It encrypts FIDO protocol messages exchanged between the client and the relying party server
Correct answer: It signs attestation certificates embedded in authenticators, forming the root of a verifiable trust chain
An Attestation CA issues certificates to authenticator manufacturers that are embedded in devices, creating the chain of trust relying parties use to verify authenticator genuineness.
Question 7: Which of the following fields is typically found in a FIDO Metadata Statement?
- User credentials and their associated public keys for a given relying party
- Authenticator AAGUID, supported cryptographic algorithms, and attestation root certificates (Correct answer)
- Relying party domain names and their per-site authentication security policies
- Session tokens, their associated scopes, and their expiration timestamps
Correct answer: Authenticator AAGUID, supported cryptographic algorithms, and attestation root certificates
A metadata statement contains the authenticator's AAGUID, supported COSE algorithm identifiers, certification status, and the root certificates required to verify that authenticator's attestation.
FCP FIDO Attestation and Metadata 1
What is the primary purpose of attestation in FIDO2/WebAuthn?