FCP FIDO Attestation and Metadata 2

Question 1

What is an AAGUID in the context of FIDO2 authenticators?

Accepted Answer

An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model

Answer

An Advanced Authentication Gateway Universal Identifier assigned to each relying party

Answer

An Access Authorization Group User ID assigned to a user during enrollment

Answer

An Asymmetric Algorithm Global Unique Index for cataloging cryptographic key types

Question 2

Which attestation type provides a certificate chain rooted in the authenticator manufacturer's attestation CA, with each device holding a unique attestation key?

Accepted Answer

Basic attestation

Answer

Self attestation

Answer

None attestation

Answer

Surrogate attestation

Question 3

What is 'self attestation' (also called surrogate attestation) in WebAuthn?

Accepted Answer

The authenticator signs the attestation using the credential private key itself, providing no independent trust anchor

Answer

The user attests to their own identity using biometrics verified against an on-device template

Answer

A server-side attestation mechanism where the relying party validates its own TLS certificate

Answer

An attestation method where users manually confirm their device model through a separate verification channel

Question 4

What key improvement does FIDO MDS version 3 (MDS3) introduce compared to MDS2?

Accepted Answer

It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling

Answer

It adds a password-based fallback for authenticators that fail attestation

Answer

It replaces X.509 certificates with symmetric key attestation for simpler deployment

Answer

It eliminates the need for authenticator manufacturer certification requirements

Question 5

When a relying party sets the attestation conveyance preference to 'direct,' what is the expected behavior?

Accepted Answer

The client returns the authenticator's raw attestation statement directly to the relying party for verification

Answer

The client bypasses attestation entirely and registers the credential without any verification

Answer

The server directly contacts the authenticator manufacturer's API to fetch attestation data out-of-band

Answer

Attestation is outsourced to a trusted third party designated by the relying party

Question 6

What is Enterprise Attestation in FIDO2, and what does it enable?

Accepted Answer

A feature that allows enterprises to obtain unique, device-identifiable attestation statements for fleet management

Answer

An attestation method exclusively licensed for government and military security programs

Answer

A commercial FIDO Alliance certification tier for enterprise-grade authenticator manufacturers

Answer

An attestation variant that uses corporate SSO tokens as the trust anchor for credential verification

Question 7

What is the purpose of the 'fmt' field in a WebAuthn attestation object?

Accepted Answer

It identifies the attestation statement format so the relying party knows how to parse and verify it

Answer

It specifies the encoding format used to serialize the credential public key

Answer

It indicates the firmware version currently running on the authenticator hardware

Answer

It defines which version of the WebAuthn specification the client platform supports