EIDAUTH-007: FIDO2 Key ROCA Vulnerability Check
- Platform
- Entra ID / M365
- Category
- Entra ID Authentication Methods & MFA
- Severity
- Critical
- Zero Trust pillar
- Identity (weight 3)
- Golden fixtures
- 1
- Branch coverage
- Observed: fixtures prove the verdicts they exercise
- Provenance
- baseline
What it checks
The ROCA (Return of Coppersmith's Attack) vulnerability (CVE-2017-15361) affects RSA key generation in Infineon TPM firmware used in certain FIDO2 security keys, allowing private key recovery from public keys. Affected keys produce weak RSA key pairs that can be factored, completely undermining the security of the authentication credential. Keys with vulnerable firmware must be identified and replaced immediately.
Recommended value
No FIDO2 keys with ROCA-vulnerable Infineon TPM firmware in use
Remediation
Identify FIDO2 keys using Infineon TPMs by checking the AAGUID values against known vulnerable models. Test registered keys using ROCA detection tools to confirm vulnerability status. Replace all affected keys with patched firmware versions or alternative hardware and revoke the old key registrations in Entra ID.
Fixture-proven verdicts
Every verdict below is proven by a golden fixture in the module's gating test suite. This table derives from the last green run; it cannot be edited by hand.
| Scenario | Expected verdict |
|---|---|
| not-implemented | Not Assessed |
Framework mappings
- NIST SP 800-53
- IA-2(6), RA-5
- MITRE ATT&CK
- T1556