FIDO Server now enables the use of the FIDO MetaDataService (MDS) 3.x. SKFS is configured to automatically download FIDO MDS and load it in memory at regular intervals. It is governed by the following properties (shown with default values):

• The following property defines if MDS should be downloaded and used or not
  skfs.cfg.property.mds.enabled=true
• The following property defines if a transaction can continue if there is no entry in the MDS service and if the property above is enabled
  skfs.cfg.property.mds.missingaaguid.register
• This following property defined the URL from where the FIDO Alliance MDS is being downloaded:
  skfs.cfg.property.mds.fidoalliance.loadmethod.url
• The following property defines the location of the ROOT CA certificate that signed the MDS:
  skfs.cfg.property.mds.fidoalliance.rootca.loadmethod.url

SKFS attempts to download the MDS every day and checks if there is an update. If there is an update, then it parses the full MDS and loads up all the statements in memory.

Below is an example of the full SKFS Policy MDS JSON section; the SKFS Policy MDS section defines authenticator status behaviors and MDS certificate check resolutions:

"mds": {
  "authenticatorStatusReport": [
  {
    "status": "FIDO_CERTIFIED_L1",
    "priority": "1",
    "decision": "IGNORE"
  },
  {
    "status": "FIDO_CERTIFIED_L2",
    "priority": "1",
    "decision": "ACCEPT"
  },
  {
    "status": "UPDATE_AVAILABLE",
    "priority": "5",
    "decision": "IGNORE"
  },
  {
    "status": "REVOKED",
    "priority": "10",
    "decision": "DENY"
  }],
  "checkResolutions": {
    "enabled": true,
    "noAaguidInMds": "ACCEPT",
    "hasX5c": {
      "hasMdsAttestation": {
        "invalidPkix": "DENY"
      },
      "noMdsAttestation": {
        "invalidPkix": "DENY"
      }
    },
    "noX5c": {
      "hasMdsAttestation": {
        "formatNone": "DENY",
        "formatPacked": "DENY"
      },
      "noMdsAttestation": "ACCEPT"
    }
  }
}

As of 4.4.3, MDS is only configured to work with packed attestation.