FIDO Attestation & Trust Models 2

Question 1

What is self attestation in WebAuthn, and what is its main limitation?

Accepted Answer

The authenticator uses the credential private key as the attestation key, providing no independent verification of the device model

Answer

The authenticator sends its serial number to the relying party, which then queries the manufacturer

Answer

The user self-certifies their identity by entering a PIN during registration

Answer

The relying party generates its own attestation certificate to track users

Question 2

What role does an Attestation CA (AttCA) play in FIDO authentication?

Accepted Answer

It issues short-lived attestation certificates to authenticators at authentication time, preserving privacy while still providing verification

Answer

It replaces the relying party's server-side credential store

Answer

It acts as a centralized identity provider similar to OAuth

Answer

It stores and rotates the authenticator's private keys on behalf of the user

Question 3

Which FIDO Authenticator Certification level requires the highest level of hardware security, including resistance to physical attacks?

Accepted Answer

Level 3 (L3)

Answer

Level 1 (L1)

Answer

Level 1+ (L1+)

Answer

Level 2 (L2)

Question 4

In a TPM-based attestation, what is the significance of the Endorsement Key (EK)?

Accepted Answer

It is a manufacturer-provisioned asymmetric key that proves a genuine TPM is present and establishes the chain of trust

Answer

It is used to sign the WebAuthn challenge directly

Answer

It encrypts user biometric data stored in the TPM

Answer

It serves as the relying party's root certificate for validating attestation

Question 5

What does the FIDO MDS3 metadata statement field 'authenticatorGetInfo' contain?

Accepted Answer

Device capabilities reported by the authenticator's CTAP2 getInfo command, such as supported transports and extensions

Answer

The list of relying parties where the authenticator is registered

Answer

The private key material needed to sign attestation statements

Answer

A record of all credentials ever issued by that authenticator model

Question 6

When a relying party sets attestation conveyance preference to 'direct', what is it requesting?

Accepted Answer

That the authenticator's raw attestation statement be delivered to the server without client-side anonymization

Answer

That no attestation be collected to protect user privacy

Answer

That the attestation be validated by the FIDO Alliance on behalf of the relying party

Answer

That the user manually upload their authenticator's certificate file

Question 7

What is the purpose of the 'aaguid' field included in the authenticator data (authData) during WebAuthn registration?

Accepted Answer

To allow the relying party to look up the authenticator model in the FIDO MDS and apply appropriate trust policies

Answer

To uniquely identify this specific credential for future authentication

Answer

To provide the user's account identifier to the authenticator

Answer

To encrypt the public key before it is sent to the relying party