FCP FIDO Attestation and Metadata 2

Question 1

What is an AAGUID in the context of FIDO2 authenticators?

Accepted Answer

An Authenticator Attestation Globally Unique Identifier that identifies a specific authenticator model

Answer

The AAGUID is a 128-bit identifier that uniquely identifies a specific model of authenticator, allowing relying parties to look up the corresponding metadata statement.

Question 2

Which attestation type provides a certificate chain rooted in the authenticator manufacturer's attestation CA, with each device holding a unique attestation key?

Accepted Answer

Basic attestation

Answer

Basic attestation gives each authenticator device a unique attestation key pair signed by the manufacturer's CA, enabling a full PKI trust chain up to a known root.

Question 3

What is 'self attestation' (also called surrogate attestation) in WebAuthn?

Accepted Answer

The authenticator signs the attestation using the credential private key itself, providing no independent trust anchor

Answer

Self attestation occurs when the authenticator uses the newly created credential key to sign the attestation, offering no independent way for a relying party to verify the authenticator's make or model.

Question 4

What key improvement does FIDO MDS version 3 (MDS3) introduce compared to MDS2?

Accepted Answer

It uses a signed JWT blob format with improved metadata structure and enhanced revocation handling

Answer

MDS3 distributes metadata as a signed JWT blob, providing better revocation support, a more structured format, and a more scalable distribution mechanism than MDS2's individual JSON files.

Question 5

When a relying party sets the attestation conveyance preference to 'direct,' what is the expected behavior?

Accepted Answer

The client returns the authenticator's raw attestation statement directly to the relying party for verification

Answer

The 'direct' conveyance preference instructs the browser and authenticator to provide the raw attestation statement to the relying party so it can perform its own verification.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FIDO Attestation and Metadata 2