FCP FIDO Attestation and Metadata 2 — Questions and Answers
Question 1: What is an AAGUID in the context of FIDO2 authenticators?
- An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model (Correct answer)
- An Advanced Authentication Gateway Universal Identifier assigned to each relying party
- An Access Authorization Group User ID assigned to a user during enrollment
- An Asymmetric Algorithm Global Unique Index for cataloging cryptographic key types
Correct answer: An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model
The AAGUID is a 128-bit identifier that uniquely identifies a specific model of authenticator, allowing relying parties to look up the corresponding metadata statement.
Question 2: Which attestation type provides a certificate chain rooted in the authenticator manufacturer's attestation CA, with each device holding a unique attestation key?
- Self attestation
- None attestation
- Basic attestation (Correct answer)
- Surrogate attestation
Correct answer: Basic attestation
Basic attestation gives each authenticator device a unique attestation key pair signed by the manufacturer's CA, enabling a full PKI trust chain up to a known root.
Question 3: What is 'self attestation' (also called surrogate attestation) in WebAuthn?
- The user attests to their own identity using biometrics verified against an on-device template
- The authenticator signs the attestation using the credential private key itself, providing no independent trust anchor (Correct answer)
- A server-side attestation mechanism where the relying party validates its own TLS certificate
- An attestation method where users manually confirm their device model through a separate verification channel
Correct answer: The authenticator signs the attestation using the credential private key itself, providing no independent trust anchor
Self attestation occurs when the authenticator uses the newly created credential key to sign the attestation, offering no independent way for a relying party to verify the authenticator's make or model.
Question 4: What key improvement does FIDO MDS version 3 (MDS3) introduce compared to MDS2?
- It adds a password-based fallback for authenticators that fail attestation
- It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling (Correct answer)
- It replaces X.509 certificates with symmetric key attestation for simpler deployment
- It eliminates the need for authenticator manufacturer certification requirements
Correct answer: It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling
MDS3 distributes metadata as a signed JWT blob, providing better revocation support, a more structured format, and a more scalable distribution mechanism than MDS2's individual JSON files.
Question 5: When a relying party sets the attestation conveyance preference to 'direct,' what is the expected behavior?
- The client bypasses attestation entirely and registers the credential without any verification
- The client returns the authenticator's raw attestation statement directly to the relying party for verification (Correct answer)
- The server directly contacts the authenticator manufacturer's API to fetch attestation data out-of-band
- Attestation is outsourced to a trusted third party designated by the relying party
Correct answer: The client returns the authenticator's raw attestation statement directly to the relying party for verification
The 'direct' conveyance preference instructs the browser and authenticator to provide the raw attestation statement to the relying party so it can perform its own verification.
Question 6: What is Enterprise Attestation in FIDO2, and what does it enable?
- An attestation method exclusively licensed for government and military security programs
- A feature that allows enterprises to obtain unique, device-identifiable attestation statements for fleet management (Correct answer)
- A commercial FIDO Alliance certification tier for enterprise-grade authenticator manufacturers
- An attestation variant that uses corporate SSO tokens as the trust anchor for credential verification
Correct answer: A feature that allows enterprises to obtain unique, device-identifiable attestation statements for fleet management
Enterprise Attestation allows organizations to configure authenticators to return unique attestation signatures per device, enabling IT departments to track and manage individual devices at the cost of reduced user anonymity.
Question 7: What is the purpose of the 'fmt' field in a WebAuthn attestation object?
- It specifies the encoding format used to serialize the credential public key
- It identifies the attestation statement format so the relying party knows how to parse and verify it (Correct answer)
- It indicates the firmware version currently running on the authenticator hardware
- It defines which version of the WebAuthn specification the client platform supports
Correct answer: It identifies the attestation statement format so the relying party knows how to parse and verify it
The 'fmt' field names the attestation statement format (e.g., 'packed', 'tpm', 'fido-u2f'), which the relying party uses to select the correct verification algorithm and parser.
FCP FIDO Attestation and Metadata 2
What is an AAGUID in the context of FIDO2 authenticators?