FIDO Attestation & Trust Models 3

Question 1

How does enterprise attestation differ from standard FIDO attestation?

Accepted Answer

Enterprise attestation allows relying parties to receive unique device identifiers, enabling per-device tracking within a controlled enterprise context

Answer

Enterprise attestation is designed for managed environments and permits unique device-identifying information in the attestation, which would otherwise violate FIDO's privacy model.

Question 2

If a FIDO MDS entry marks an authenticator's status as 'REVOKED', what should a relying party do?

Accepted Answer

Reject new registrations from that authenticator model and consider invalidating existing credentials made with it

Answer

A REVOKED status indicates the authenticator can no longer be trusted, so relying parties should block new registrations and evaluate whether existing credentials remain acceptable.

Question 3

Which of the following correctly describes how 'none' attestation affects a relying party's ability to enforce authenticator policy?

Accepted Answer

It gives the relying party no cryptographic information about the authenticator, making it impossible to enforce hardware requirements

Answer

When 'none' attestation is used, no attestation statement is produced, so the relying party cannot cryptographically verify the authenticator type or enforce hardware security requirements.

Question 4

What is the role of the 'x5c' field within a packed attestation statement?

Accepted Answer

It carries the attestation certificate chain used to verify the attestation signature back to a trusted root

Answer

The x5c field contains an ordered array of DER-encoded X.509 certificates forming the attestation certificate chain, enabling signature validation up to a known root CA.

Question 5

In the FIDO trust model, what distinguishes a 'conformance' certificate from a 'certified' authenticator listing in the MDS?

Accepted Answer

Conformance testing verifies spec correctness through automated test suites, while certification also includes security reviews and physical security evaluation

Answer

FIDO conformance validates that an implementation correctly follows the specification via test suites, while full authenticator certification additionally evaluates security properties and may involve lab testing.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Attestation & Trust Models 3