Which term describes the capability of an authenticator to prove it is a root of trust and provide reliable reporting to prove platform trustworthiness?

Which term describes the capability of an authenticator to prove it is a root of trust and provide reliable reporting to prove platform trustworthiness?

• A. Permissions
• B. Group Account
• C. Attestation
• D. MAC

Answer: (C)

Attestation is the process by which an authenticator proves it can be trusted by sharing signed evidence about its hardware and software state. This evidence, often generated from a secure root of trust built into the device (such as a TPM or secure enclave), measures the platform from boot onward and stores those measurements in protected registers. When the authenticator communicates with a relying party, it can produce an attestation report that is signed with keys anchored to that root of trust. The verifier can then check the report to confirm the platform state is trustworthy, providing reliable confirmation of platform integrity. Permissions describe what actions are allowed, not the device’s trust state. A Group Account is a shared credential for multiple users, not a mechanism for proving platform trust. A MAC is a cryptographic tag used to protect data integrity and authenticity of a message, but it does not convey a trust report about the device’s state or establish a root of trust.

Attestation is the process by which an authenticator proves it can be trusted by sharing signed evidence about its hardware and software state. This evidence, often generated from a secure root of trust built into the device (such as a TPM or secure enclave), measures the platform from boot onward and stores those measurements in protected registers. When the authenticator communicates with a relying party, it can produce an attestation report that is signed with keys anchored to that root of trust. The verifier can then check the report to confirm the platform state is trustworthy, providing reliable confirmation of platform integrity.

Permissions describe what actions are allowed, not the device’s trust state. A Group Account is a shared credential for multiple users, not a mechanism for proving platform trust. A MAC is a cryptographic tag used to protect data integrity and authenticity of a message, but it does not convey a trust report about the device’s state or establish a root of trust.