FIDO Attestation & Trust Models 1 — Questions and Answers
Question 1: What is the primary purpose of FIDO attestation during authenticator registration?
- To encrypt the user's private key on the server
- To allow a relying party to verify the authenticator model and its security properties (Correct answer)
- To establish a shared secret between the client and server
- To provide a recovery mechanism if the authenticator is lost
Correct answer: To allow a relying party to verify the authenticator model and its security properties
FIDO attestation lets the relying party cryptographically verify what type of authenticator produced the credential and confirm its security characteristics.
Question 2: Which of the following is NOT one of the defined WebAuthn attestation statement formats?
- packed
- tpm
- android-safetynet
- fido-u2f-legacy (Correct answer)
Correct answer: fido-u2f-legacy
The defined formats are packed, tpm, android-safetynet, android-key, fido-u2f, apple, and none; 'fido-u2f-legacy' is not a valid format.
Question 3: What does an Authenticator Attestation GUID (AAGUID) uniquely identify?
- An individual authenticator device by its serial number
- A specific model and batch of authenticator from a particular manufacturer (Correct answer)
- A single registered credential on a relying party
- The user's identity within the FIDO ecosystem
Correct answer: A specific model and batch of authenticator from a particular manufacturer
The AAGUID identifies the authenticator model (make and model), not individual devices, allowing relying parties to look up model-level metadata.
Question 4: Which attestation type offers the strongest assurance because it uses a manufacturer-issued certificate specific to each individual authenticator?
- Self attestation
- Basic attestation (Correct answer)
- AttCA attestation
- None attestation
Correct answer: Basic attestation
Basic attestation uses a device-specific attestation certificate signed by the manufacturer's CA, providing high assurance of authenticator provenance.
Question 5: In the context of FIDO, what is a 'trust anchor'?
- The server-side component that stores all public keys
- A root certificate or public key that a relying party trusts to validate an attestation certificate chain (Correct answer)
- The PIN or biometric used to unlock an authenticator
- A cryptographic nonce generated during the challenge-response flow
Correct answer: A root certificate or public key that a relying party trusts to validate an attestation certificate chain
A trust anchor is the root of trust — typically a root CA certificate — against which the attestation certificate chain is validated.
Question 6: What information does the FIDO Alliance Metadata Service (MDS) primarily provide to relying parties?
- Real-time authentication session tokens
- Metadata entries describing authenticator security characteristics, certification status, and attestation root certificates (Correct answer)
- User biometric templates collected from registered devices
- Lists of revoked WebAuthn credentials across all sites
Correct answer: Metadata entries describing authenticator security characteristics, certification status, and attestation root certificates
MDS provides a signed JSON dataset with authenticator metadata entries including security details, certification levels, and the trust anchors needed to validate attestation.
Question 7: Which attestation conveyance preference value instructs the client to request attestation only if it can be obtained without additional user interaction?
- none
- indirect (Correct answer)
- direct
- enterprise
Correct answer: indirect
The 'indirect' conveyance preference requests attestation but allows the client to substitute or anonymize it, without requiring extra prompts to the user.
FIDO Attestation & Trust Models 1
What is the primary purpose of FIDO attestation during authenticator registration?