What is the AAGUID in WebAuthn?

An Authenticator Attestation Global Unique Identifier (AAGUID) is a 128-bit identifier indicating the model of the authenticator. This unique ID is used to ascertain the origin and security characteristics of the authenticator during the registration phase, ensuring a robust and secure user authentication process. As part of the WebAuthn standards:

• It provides a layer of trustworthiness to the entire authentication process.
• Makes it possible to identify and validate the type and model of the authenticator device.
• Ensures that the user is interacting with a trusted and genuine authenticator.

---

The world of online security is fraught with risks, and it's imperative to ensure that each authentication step is both secure and trustworthy. This is where the AAGUID comes into play. But what exactly does it entail?

• Origins: As part of the FIDO Alliance's WebAuthn specification, the AAGUID was introduced to bolster the security and trustworthiness of the authentication process.
• Functionality: When a user registers an authenticator, the AAGUID is transmitted as part of the attestation data. This allows platforms and relying parties to determine the type and security characteristics of the authenticator, ensuring that it's a genuine and trusted device.
• Security Implications: By ensuring that the authenticator's model can be identified and validated, the AAGUID acts as a barrier against malicious actors using untrusted or spoofed devices to compromise user security.

---

In the following table, you find an overview of common AAGUIDs and the corresponding passkey provider:

---

The AAGUID helps in identifying and validating the type and model of the authenticator during the registration phase, ensuring users are interacting with a genuine device, thus promoting a secure authentication process.

The AAGUID is specifically designed for authenticators within WebAuthn. It's a unique 128-bit identifier that signifies the model of the authenticator, setting it apart from generic identifiers.

While the WebAuthn specification strongly advocates for its use, it's up to the individual implementations and relying parties to decide its necessity based on their security requirements.

The AAGUID 00000000-0000-0000-0000-000000000000 is a special value indicating that the authenticator is not providing detailed information about its type or manufacturer, often used in cases where attestation is not provided or required (e.g. Apple used this AAGUID for a long time to not disclose too many user details, as Apple devices are not supporting attestation). Essentially, it represents a generic or unspecified authenticator in the context of WebAuthn.