FCP FIDO Attestation and Metadata 3

Question 1

Which cryptographic algorithm is most commonly used in packed attestation for signing the attestation statement?

Accepted Answer

ECDSA with the P-256 curve and SHA-256 (ES256)

Answer

RSA-1024 with SHA-1 for compatibility with legacy systems

Answer

HMAC-SHA256 using a symmetric secret shared with the manufacturer

Answer

RC4 with a 128-bit key for fast computation on constrained hardware

Question 2

How does a relying party use an authenticator's AAGUID in relation to the FIDO Metadata Service?

Accepted Answer

The relying party uses the AAGUID as a lookup key to retrieve the authenticator's metadata statement from the MDS

Answer

The MDS assigns and distributes AAGUIDs to authenticator manufacturers upon certification

Answer

The AAGUID replaces the MDS entirely in FIDO2, eliminating the need for a centralized metadata repository

Answer

The MDS generates a new AAGUID for each registration event to ensure per-credential uniqueness

Question 3

After receiving an attestation statement during registration, what steps does a relying party typically perform?

Accepted Answer

Verifies the attestation signature and certificate chain, then queries the MDS for current authenticator status

Answer

Forwards the attestation statement to the FIDO Alliance server for real-time third-party validation

Answer

Stores the encrypted attestation statement alongside the credential for future offline verification only

Answer

Rejects any authenticator that provides an attestation statement to protect user privacy by default

Question 4

What does an authenticator status of 'REVOKED' in the FIDO MDS indicate?

Accepted Answer

The authenticator model has a known security vulnerability and credentials from it should no longer be trusted

Answer

The authenticator model's firmware is outdated and must be updated before it can be used

Answer

The authenticator's FIDO certification has expired and requires renewal through the FIDO Alliance

Answer

The authenticator requires additional field testing before it can be accepted by relying parties

Question 5

What privacy concern arises specifically from using Basic attestation with batch attestation certificates?

Accepted Answer

The shared batch certificate across an authenticator model can be used to correlate registrations across different relying parties

Answer

Basic attestation requires transmitting user biometric templates to the relying party server

Answer

Basic attestation transmits the user's full legal identity to the FIDO Alliance for compliance logging

Answer

It exposes the user's IP address to the authenticator manufacturer during every authentication event

Question 6

Which WebAuthn attestation conveyance preference allows the client platform to decide how to provide attestation, potentially using an Anonymization CA?

Accepted Answer

indirect

Answer

direct

Answer

none

Answer

enterprise

Question 7

What is the function of an Anonymization CA (AnonCA) in FIDO attestation?

Accepted Answer

It re-signs authenticator attestation statements with a different certificate, preventing cross-site tracking while preserving trust

Answer

It anonymizes the relying party's identity in attestation requests to protect business confidentiality

Answer

It issues anonymous user certificates that replace public keys for privacy-sensitive authentication scenarios

Answer

It strips all attestation data from the credential before forwarding it to the relying party server