FCP FIDO Attestation and Metadata 3

Question 1

Which cryptographic algorithm is most commonly used in packed attestation for signing the attestation statement?

Accepted Answer

ECDSA with the P-256 curve and SHA-256 (ES256)

Answer

Packed attestation commonly uses ECDSA P-256 / SHA-256 (COSE algorithm ES256) because it provides strong security with small key sizes and efficient computation on authenticator hardware.

Question 2

How does a relying party use an authenticator's AAGUID in relation to the FIDO Metadata Service?

Accepted Answer

The relying party uses the AAGUID as a lookup key to retrieve the authenticator's metadata statement from the MDS

Answer

The AAGUID extracted from authenticator data during registration is used as a primary key to query the FIDO MDS and retrieve the metadata statement for that specific authenticator model.

Question 3

After receiving an attestation statement during registration, what steps does a relying party typically perform?

Accepted Answer

Verifies the attestation signature and certificate chain, then queries the MDS for current authenticator status

Answer

The relying party verifies the attestation signature and certificate chain locally, then looks up the authenticator's AAGUID in the MDS to check for current certification status or security advisories.

Question 4

What does an authenticator status of 'REVOKED' in the FIDO MDS indicate?

Accepted Answer

The authenticator model has a known security vulnerability and credentials from it should no longer be trusted

Answer

A 'REVOKED' MDS status means the authenticator model has been compromised or found to have a critical security flaw, and relying parties implementing MDS checks should reject credentials from such devices.

Question 5

What privacy concern arises specifically from using Basic attestation with batch attestation certificates?

Accepted Answer

The shared batch certificate across an authenticator model can be used to correlate registrations across different relying parties

Answer

Because all devices of the same batch share a single attestation certificate, a colluding set of relying parties could use that certificate to link registrations from the same device across different sites.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FIDO Attestation and Metadata 3