Ambimat GroupAmbimatAmbiSecureSIMAuthAmbiAutomationEngineering BlogAhmedabad · India · Est. 1982
ASAmbiSecureHardware-rooted security
Contact

An AAGUID (Authenticator Attestation GUID) is a 128-bit identifier that names the make and model of a FIDO2/WebAuthn authenticator. It appears in the attested credential data of a registration response, letting a relying party recognise which authenticator model created a credential — useful for enterprise policy (allow-listing certified models) and for showing a friendly device name. A zeroed AAGUID means the authenticator intentionally does not identify its model.

FIDO MDS

FIDO AAGUID reference database

Curated AAGUID directory. Search by vendor, model, or AAGUID. Filter by vendor. Production should fetch the FIDO MDS BLOB for authoritative status.

AmbiSecure authenticators are not listed here. An AAGUID is assigned to a model through FIDO certification, and we publish ours once the registered value appears in the FIDO Metadata Service — a provisional or sample identifier in a reference table is indistinguishable from a real one, so we do not list one.

What this reference covers

Spec

FIDO Metadata Service v3.

Companion tool

AAGUID lookup · FIDO Metadata Explorer

Reading

Attestation objects

Usage notes

The AAGUID is only present when attestation is conveyed and the authenticator chooses to identify itself; platform authenticators often report an all-zero AAGUID for privacy. To map an AAGUID to a product name and its certification status, cross-reference the FIDO Alliance Metadata Service (MDS), which publishes authenticator metadata keyed by AAGUID.

  • Do not treat the AAGUID as a per-user or per-device secret — it identifies a model, not an individual authenticator, and many devices share one.
  • Enforce model policy against verified MDS metadata, not the self-reported AAGUID alone, unless attestation is validated.
  • Look up an AAGUID with the AAGUID lookup tool and explore metadata with the FIDO MDS explorer.

Frequently asked questions

What is an AAGUID?

A 16-byte identifier for the make and model of a FIDO2 authenticator. Every unit of a model shares one, so it identifies a device type without identifying a user.

Why would an enterprise care about AAGUIDs?

Because they are how authenticator policy is expressed — allowing only approved models to enrol, and reporting on what is deployed across an estate.

Why is this a curated subset?

It covers well-known consumer and enterprise devices for orientation. The authoritative source is the FIDO Metadata Service BLOB, which is signed and should be fetched and verified in production.

What does an all-zero AAGUID mean?

The authenticator withheld its identity — normal for platform authenticators and for any registration requesting no attestation.

Where do I find the AAGUID in a registration?

Inside attested credential data in authenticatorData, immediately after the signature counter. The authenticatorData parser will extract it.