Describe the bug
In TocService.java:434-436, the processMetadataEntries method parses three types of authenticator identifiers from the FIDO MDS TOC blob, namely aaguid for FIDO2 authenticators, aaid for FIDO UAF authenticators, and attestationCertificateKeyIdentifiers for U2F authenticators. While the aaguid and attestationCertificateKeyIdentifiers cases are properly handled through their respective processing methods, the aaid branch is not implemented and only logs a debug-level TODO message. As a result, AAID-based entries are never inserted into tocEntries, causing getAuthenticatorsMetadata(aaid) to always return null for any UAF authenticator.
Expected behavior
AAID entries should be processed and added to tocEntries, keyed by the AAID value, after proper status verification, mirroring the behavior implemented in processAaguidEntry for AAGUID entries.
Impact
All FIDO UAF authenticators whose MDS TOC entries include an aaid field have their metadata silently dropped during startup. Any downstream attestation verification that depends on AAID-based metadata lookup will receive null, which can lead to verification failures or silent degradation. This issue is difficult to detect because the only indication in logs is a warning such as WARN: No entry found for AAGUID, which does not clearly point to the missing AAID handling.
Describe the bug
In TocService.java:434-436, the processMetadataEntries method parses three types of authenticator identifiers from the FIDO MDS TOC blob, namely aaguid for FIDO2 authenticators, aaid for FIDO UAF authenticators, and attestationCertificateKeyIdentifiers for U2F authenticators. While the aaguid and attestationCertificateKeyIdentifiers cases are properly handled through their respective processing methods, the aaid branch is not implemented and only logs a debug-level TODO message. As a result, AAID-based entries are never inserted into tocEntries, causing getAuthenticatorsMetadata(aaid) to always return null for any UAF authenticator.
Expected behavior
AAID entries should be processed and added to tocEntries, keyed by the AAID value, after proper status verification, mirroring the behavior implemented in processAaguidEntry for AAGUID entries.
Impact
All FIDO UAF authenticators whose MDS TOC entries include an aaid field have their metadata silently dropped during startup. Any downstream attestation verification that depends on AAID-based metadata lookup will receive null, which can lead to verification failures or silent degradation. This issue is difficult to detect because the only indication in logs is a warning such as WARN: No entry found for AAGUID, which does not clearly point to the missing AAID handling.