FIDO Attestation & Trust Models 3

Question 1

How does enterprise attestation differ from standard FIDO attestation?

Accepted Answer

Enterprise attestation allows relying parties to receive unique device identifiers, enabling per-device tracking within a controlled enterprise context

Answer

Enterprise attestation disables all cryptographic signing to reduce latency in corporate environments

Answer

Enterprise attestation replaces the user's biometric with a corporate PIN policy

Answer

Enterprise attestation stores credentials on a central corporate server rather than the authenticator

Question 2

If a FIDO MDS entry marks an authenticator's status as 'REVOKED', what should a relying party do?

Accepted Answer

Reject new registrations from that authenticator model and consider invalidating existing credentials made with it

Answer

Continue accepting registrations but log them for audit

Answer

Prompt the user to update the authenticator's firmware before proceeding

Answer

Redirect the user to purchase a replacement authenticator through the FIDO Alliance store

Question 3

Which of the following correctly describes how 'none' attestation affects a relying party's ability to enforce authenticator policy?

Accepted Answer

It gives the relying party no cryptographic information about the authenticator, making it impossible to enforce hardware requirements

Answer

It provides the strongest privacy guarantees while still allowing full device model verification

Answer

It forces the relying party to accept any authenticator, regardless of firmware version

Answer

It routes attestation through the FIDO Alliance, which enforces policy on the relying party's behalf

Question 4

What is the role of the 'x5c' field within a packed attestation statement?

Accepted Answer

It carries the attestation certificate chain used to verify the attestation signature back to a trusted root

Answer

It contains the credential public key in PEM format

Answer

It holds the AAGUID in base64url-encoded form

Answer

It specifies the signature algorithm used for the WebAuthn challenge

Question 5

In the FIDO trust model, what distinguishes a 'conformance' certificate from a 'certified' authenticator listing in the MDS?

Accepted Answer

Conformance testing verifies spec correctness through automated test suites, while certification also includes security reviews and physical security evaluation

Answer

Conformance certificates are issued by relying parties, while certified listings come from the FIDO Alliance

Answer

Conformance applies only to software authenticators, while certification covers hardware tokens

Answer

Certified listings require a government audit, whereas conformance only requires an internal self-assessment

Question 6

An Android application uses the 'android-key' attestation format. What does this indicate about where the key material is protected?

Accepted Answer

The key pair was generated and is stored in Android Keystore, backed by hardware security if the device supports it

Answer

The key is stored in the app's SharedPreferences in an encrypted form

Answer

The key is derived from the user's Google account password

Answer

The key is stored on a companion FIDO hardware token connected via Bluetooth

Question 7

Why does the FIDO privacy model require that standard (non-enterprise) attestation certificates NOT contain information unique to an individual authenticator unit?

Accepted Answer

To prevent relying parties from correlating a user's registrations across different sites using a unique device identifier

Answer

To reduce the size of the attestation statement and improve registration performance

Answer

To comply with export control laws that restrict sharing hardware serial numbers

Answer

To allow authenticator manufacturers to reuse certificates across product generations