FIDO Alliance

Passkey Central

Authenticate Conference

MDS Changelog

August 2026

For August, pay special attention to the root certificate update, as this is a mandatory update for anyone using FIDO MDS on their server. Also, authenticators with Authenticator Security Requirements 1.6 and 1.7 as well as those with Authenticator Policy Version 1.4.1 can now be listed in MDS.

MDS Service

Changed

  • Update to Root Certificate (MAJOR) If you have implemented FIDO MDS on your server, the GlobalSign root certificate has been updated from R3 to R46. The new root certificate can be found on https://valid.r46.roots.globalsign.com/. In order to continue to verify the MDS BLOB’s digital signature, you will need to update information for the root certificate in your code. If you do not, you will receive an error message that the MD3 BLOB cannot be validated. Relying parties must validate the chain of trust against this root to ensure data integrity.

MDS Portal

Changed

  • Logo Update (MINOR) The FIDO logo used for MDS Portal notifications and within the MDS Portal UI has been updated to the latest version. 
The latest FIDO logo. Black letters on white background.

Added

  • Authenticator Security Requirements Version (MINOR) The ability to list authenticators with Authenticator Security Requirements 1.6 and 1.7 is now available in MDS. 
  • Authenticator Policy Version (MINOR) The ability to list authenticators with Authenticator Policy Version 1.4.1 is now available in MDS.

July 2026

Notable changes for this release include the addition of two new user guides, written to help with use of the MDS Portal and addition of metadata statements. Also, a user feedback form was added to the MDS Portal and a patch was implemented for the MDS Portal. 

In addition, improvements have been made to the UI within the MDS Portal to add clarity and enhance the user experience. These changes are focused on creating a better user experience and should not affect functionality. 

Two patches were implemented for the FIDO Convenience Metadata Service specifications.

MDS Portal

Added

  • New Navigation Button (MINOR) A User Guides button was added to the mymds.org UI for quick access to the user guides from the MDS Portal.

Fixed

  • UI Improvements (MINOR) UI improvements were made within the MDS Portal. These updates should not affect functionality.
  • New Feedback Form (PATCH) In the MDS Portal, a new user feedback form is now available and can be accessed via the Feedback link in the footer.
  • Security Profiles Field Now Optional (PATCH) On the Certification Validation Request form, the Security Profiles field is now optional. This was updated to align with specification applicability variances between UAF and CTAP versions.

FIDO Convenience Metadata Service

Fixed

3.1.1 – May 26, 2026

Please review the following changelog entry along with the updated specifications. If you are a vendor listing in the MDS, please review to see if any of the new values apply to your products. If you are a relying party (RP) consuming the MDS data, please review the updates to ensure your service is compatible.

Several changes to the MDS3 service were rolled out. These changes were made to include the updates to the FIDO CTAP 2.3 and FIDO Registry of Predefined Values 2.3 specs. In the 3.1.1 Proposed Standard spec the Registry 2.3 is now referenced. 

In addition, improvements have been made to the UI copy within the MDS Portal to add clarity and enhance the user experience. These changes are focused on creating a better user experience and should not affect functionality.

Fixed

MDS Portal 

Improvements have been made to the UI copy within the MDS Portal to add clarity and enhance the user experience. These updates should not affect functionality.

Changed

LongTouchForReset data type (FIDO CTAP 2.3)

LongTouchForReset: Changed the data type from uint? to bool? to better reflect the boolean nature of the long touch requirement for device resets.

Authenticator Service Updates (FIDO Registry of Predefined Values 2.3)

Added new attestation types: none and anonca. 

Validation Changes (FIDO Registry of Predefined Values 2.3)

Root Certificate Validation: Updated ValidateAttestationRootCertificates to allow empty certificate arrays if the attestation type is none or anonca.

View the FIDO Registry of Predefined Values 2.3. 

Infrastructure – Rate Limit Change

Rate limiting for the MDS3 BLOB download service has been adjusted. The previous setting limited downloads to two times per minute based on the requesting IP address. The limit has been been adjusted to limit downloads to once per hour. 

Reminder – localCopySerial Parameter

Please note that there is an optional parameter for requesting the MDS3 BLOB metadata blob called localCopySerial. This will allow adding a parameter to the GET request with the serial number of the MDS3 BLOB to see if a newer version is available (e.g ?localCopySerial=xx).

If there is not a newer version, the service will return an HTTP code of 304 (Not Modified).

For more details, refer to the FIDO Metadata Service – Sec. 3.2  Metadata BLOB object processing rules.

Added

AuthenticatorGetInfo properties (FIDO CTAP 2.3)

New properties were added to the AuthenticatorGetInfo class to support expanded authenticator capabilities and security policies:

  • EncIdentifier (string)
  • TransportsForReset (string[])
  • PinComplexityPolicy (bool?)
  • PinComplexityPolicyURL (string)
  • MaxPINLength (uint?)
  • EncCredStoreState (string) 
  • AuthenticatorConfigCommands (ulong[])

Refer to the section 6.4. authenticatorGetInfo (0x04) of the Client to Authenticator Protocol (CTAP) standard for more detailed information. 

Options Class Updates (FIDO CTAP 2.3)

PerCredMgmtRO (bool?): Added support for read-only Per-Credential Management, allowing for more granular control over how credentials are managed on the device.

Core Logic and Enums (FIDO Registry 2.3)

  • Added New Enums:
    • AuthenticationAlgorithm: Added ed448_eddsa_sha512_raw.
    • AttestationType: Added none and anonca.
    • KeyProtectionType: Added sync_fabric.
    • AttachmentHint: Added smart-card.

MDS3 Statement Updates (FIDO CTAP 2.3)

  • Added support for new authentication algorithms: ed448_eddsa_sha512_raw.
  • Added support for new attestation types: none and anonca.
  • Added sync_fabric to KeyProtectionType flags.
  • Added smart_card as a valid AttachmentHint.
  • Expanded AuthenticatorGetInfo to include: EncIdentifier, TransportsForReset, PinComplexityPolicy, MaxPINLength, and AuthenticatorConfigCommands.
  • Expanded Options model to include: PerCredMgmtRO.

Subscribe to the FIDO newsletter

Stay Connected, Stay Engaged

Receive the latest news, events, research and implementation guidance from the FIDO Alliance. Learn about digital identity and fast, phishing-resistant authentication with passkeys.