FIDO Attestation & Trust Models 2 — Questions and Answers
Question 1: What is self attestation in WebAuthn, and what is its main limitation?
- The authenticator uses the credential private key as the attestation key, providing no independent verification of the device model (Correct answer)
- The authenticator sends its serial number to the relying party, which then queries the manufacturer
- The user self-certifies their identity by entering a PIN during registration
- The relying party generates its own attestation certificate to track users
Correct answer: The authenticator uses the credential private key as the attestation key, providing no independent verification of the device model
Self attestation signs the attestation statement with the same key pair as the credential, so there is no third-party verification of what kind of device is being used.
Question 2: What role does an Attestation CA (AttCA) play in FIDO authentication?
- It replaces the relying party's server-side credential store
- It issues short-lived attestation certificates to authenticators at authentication time, preserving privacy while still providing verification (Correct answer)
- It acts as a centralized identity provider similar to OAuth
- It stores and rotates the authenticator's private keys on behalf of the user
Correct answer: It issues short-lived attestation certificates to authenticators at authentication time, preserving privacy while still providing verification
An AttCA issues per-transaction attestation certificates, allowing strong authenticator verification without exposing a static device certificate that could be used to track users.
Question 3: Which FIDO Authenticator Certification level requires the highest level of hardware security, including resistance to physical attacks?
- Level 1 (L1)
- Level 1+ (L1+)
- Level 2 (L2)
- Level 3 (L3) (Correct answer)
Correct answer: Level 3 (L3)
L3 certification mandates robust resistance to physical attacks on the hardware, making it the most stringent certification tier in the FIDO Alliance's authenticator program.
Question 4: In a TPM-based attestation, what is the significance of the Endorsement Key (EK)?
- It is used to sign the WebAuthn challenge directly
- It is a manufacturer-provisioned asymmetric key that proves a genuine TPM is present and establishes the chain of trust (Correct answer)
- It encrypts user biometric data stored in the TPM
- It serves as the relying party's root certificate for validating attestation
Correct answer: It is a manufacturer-provisioned asymmetric key that proves a genuine TPM is present and establishes the chain of trust
The EK is burned into the TPM by the manufacturer and serves as the hardware root of trust, enabling the attestation chain to be anchored to a genuine TPM.
Question 5: What does the FIDO MDS3 metadata statement field 'authenticatorGetInfo' contain?
- The list of relying parties where the authenticator is registered
- Device capabilities reported by the authenticator's CTAP2 getInfo command, such as supported transports and extensions (Correct answer)
- The private key material needed to sign attestation statements
- A record of all credentials ever issued by that authenticator model
Correct answer: Device capabilities reported by the authenticator's CTAP2 getInfo command, such as supported transports and extensions
The authenticatorGetInfo field mirrors the CTAP2 getInfo response, advertising the authenticator's supported protocols, transports, extensions, and options.
Question 6: When a relying party sets attestation conveyance preference to 'direct', what is it requesting?
- That no attestation be collected to protect user privacy
- That the authenticator's raw attestation statement be delivered to the server without client-side anonymization (Correct answer)
- That the attestation be validated by the FIDO Alliance on behalf of the relying party
- That the user manually upload their authenticator's certificate file
Correct answer: That the authenticator's raw attestation statement be delivered to the server without client-side anonymization
The 'direct' preference asks the authenticator to provide its own attestation statement so the relying party can validate it directly without any client-side substitution.
Question 7: What is the purpose of the 'aaguid' field included in the authenticator data (authData) during WebAuthn registration?
- To uniquely identify this specific credential for future authentication
- To allow the relying party to look up the authenticator model in the FIDO MDS and apply appropriate trust policies (Correct answer)
- To provide the user's account identifier to the authenticator
- To encrypt the public key before it is sent to the relying party
Correct answer: To allow the relying party to look up the authenticator model in the FIDO MDS and apply appropriate trust policies
The AAGUID in authData lets the relying party match the device to an MDS metadata entry to retrieve security characteristics and trust anchors.
FIDO Attestation & Trust Models 2
What is self attestation in WebAuthn, and what is its main limitation?