Senior LevelAuthentication & Authorization
How do you validate FIDO2 Authenticator Attestation Statements (TPM, Android SafetyNet, Apple WebAuthn)?
❓ Interview Prompt: Explain FIDO2 CBOR attestation structures, Packed, TPM, Apple Anonymous, Android SafetyNet formats, and FIDO Metadata Service (MDS3).
During WebAuthn registration, the authenticator submits an Attestation Statement proving that the public key was generated inside a genuine, tamper-resistant hardware security model.
Server Validation Pipeline:
1
Parse CBOR Structure: Decode raw binary CBOR 'attestationObject' into 'fmt' (format) and 'attStmt' (attestation statement).
2
Format-Specific Signature Verification:
•
'packed': Verify X.509 certificate chain or EC self-signature.
•
'tpm': Verify Trusted Platform Module Endorsement Key (EK) certificate chain.
•
'apple': Verify Apple WebAuthn Root CA certificate chain.
3
FIDO MDS3 Lookup: Query the FIDO Alliance Metadata Service (MDS3) using the Authenticator AAGUID to verify hardware FIPS security certifications.
Code Implementation Example
typescript
import { decodeAttestationObject } from '@simplewebauthn/server';
function validateFidoAttestation(attestationObjectBuffer: Buffer, expectedAaguid: string) {
const decoded = decodeAttestationObject(attestationObjectBuffer);
console.log('Attestation Format:', decoded.fmt); // e.g. "packed", "tpm", "apple"
// Verify AAGUID matches hardware vendor metadata
const aaguid = decoded.authData.aaguid?.toString('hex');
if (aaguid !== expectedAaguid) {
throw new Error('Security Violation: Hardware AAGUID mismatch!');
}
}💡Parsing and verifying WebAuthn CBOR attestation object and hardware AAGUID.
🎯 Interview Key Takeaway
Validate FIDO2 attestation statements against FIDO Metadata Service (MDS3) root CAs to verify hardware security module authenticity.
#FIDO2#Attestation#CBOR#WebAuthn#Senior
Back to all Authentication & Authorization Questions→