FIDO Server now enables the use of the FIDO MetaDataService (MDS) 3.x. SKFS is configured to automatically download FIDO MDS and load it in memory at regular intervals. It is governed by the following properties (shown with default values):

• The following property defines if MDS should be downloaded and used or not
  skfs.cfg.property.mds.enabled=true
• The following property defines if a transaction can continue if there is no entry in the MDS service and if the property above is enabled
  skfs.cfg.property.mds.missingaaguid.register
• This following property defined the URL from where the FIDO Alliance MDS is being downloaded:
  skfs.cfg.property.mds.fidoalliance.loadmethod.url
• The following property defines the location of the ROOT CA certificate that signed the MDS:
  skfs.cfg.property.mds.fidoalliance.rootca.loadmethod.url

SKFS attempts to download the MDS every day and checks if there is an update. If there is an update, then it parses the full MDS and loads up all the statements in memory.

SKFS Policies contain an MDS section that defines authenticator status behaviors:

"mds": {
  "authenticatorStatusReport": [
  {
    "status": "FIDO_CERTIFIED_L1",
    "priority": "1",
    "decision": "IGNORE"
  },
  {
    "status": "FIDO_CERTIFIED_L2",
    "priority": "1",
    "decision": "ACCEPT"
  },
  {
    "status": "UPDATE_AVAILABLE",
    "priority": "5",
    "decision": "IGNORE"
  },
  {
    "status": "REVOKED",
    "priority": "10",
    "decision": "DENY"
  }]
}

When checking, SKFS looks for the authenticator status object from the MDS; based on the status, it will check the current FIDO policy and act accordingly. It can either ignore, deny, or accept the request.

As of 4.4.3, MDS is only configured to work with packed attestation.