What is the FIDO Metadata Service?

When FIDO creates a Public/Private key pair for a device, a user and a service (its a 3 way authentication), the Public key is sent to the service. How does the device know how to do this?

Step 1 – Metadata Service

FIDO operates a Metadata Service.

The FIDO Vendor supplies Metadata, as part of FIDO certification.  This metadata is held on the Metadata Service, which is pulled in by a FIDO Server on a regular basis.  

 

The DEVICE sends a PUBLIC key to the FIDO server, which uses the pulled in metadata to validate the Crypto key, with information provided by the VENDOR when the device was registered with FIDO.

 

 

So what is happening next?

 

The FIDO server downloads the Metadata from an official URL.

The FIDO server uses a digital signature to ensure the metadata has not been tampered.

The metadata cites all the authenticators known to FIDO (checks the Integrity and Authenticity of the metadata).

 

Step 2 – The Metadata carries revoked and security breach information, along with a Rogue List.

Revoked

Malware can bypass security

Rogue List

Reference:

FIDO Metadata URL

https://fidoalliance.org/specs/mds/fido-metadata-service-v3.0-ps-20210518.html

Biometrics URL

https://fidoalliance.org/specs/biometric/requirements/