Accepted devices
Demo Bank accepts a security key only if its attestation certificate chains to the maker's root
configured for its model (AAGUID). Everything else is refused at registration. The list is checked again at
every sign-in and payment: a model taken off it, or reported revoked, stops working at once.
Kyrios Lab stand-in (FIDO2Applet, TEST ONLY)
TEST ONLY
refused
AAGUID 7fd46047-20f4-4d48-a7e4-c113a3c8abd8
Trust: x509-roots
CN=Kyrios Lab Attestation Root CA,OU=Kyrios ID Lab TEST ONLY,O=Rikki Tech Innovación SL,C=ES (sha256 768f6a43a2b22264…) from kyrios-lab-attestation-root.TEST-ONLY.pem
Refused, rings already registered too: a TEST ONLY model, refused in production
Infineon SECORA ID V2 FIDO2.1 (Consumer Edition)
accepting
AAGUID 55fd881f-40ba-4eaf-8435-42c5fed08b76
Trust: mds
FIDO MDS no. 291: SECORA ID V2 by Infineon Consumer Edition (NOT_FIDO_CERTIFIED)CN=Infineon FIDO2 Root CA Serial 4964436E456431,O=Infineon Technologies AG,OU=CA for Authenticator Attestation,C=DE (sha256 ebf3c353cf5e1975…)
Infineon SECORA ID V2 FIDO2.1 (Enterprise Edition)
accepting
AAGUID 8108bdcd-8483-46b3-b3ce-359f8190325e
Trust: mds
FIDO MDS no. 291: SECORA ID V2 by Infineon Enterprise Edition (NOT_FIDO_CERTIFIED)CN=Infineon FIDO2 Root CA Serial 49644570456431,O=Infineon Technologies AG,OU=CA for Authenticator Attestation,C=DE (sha256 b8b0808449cc88b9…)
Infineon SECORA ID V2 FIDO2.1 L1 (certified card edition)
accepting
AAGUID 4e2ddbc2-2687-4709-8551-cb66c9776bfe
Trust: mds
FIDO MDS no. 291: SECORA ID V2 FIDO2.1 L1 (FIDO_CERTIFIED_L1, certificate FIDO20020241227003)CN=Infineon FIDO CA,OU=CA for Authenticator Attestation,O=Infineon Technologies AG,C=DE (sha256 159d3653d94c1d38…)
FIDO Metadata Service: verified blob no. 291, next update 2026-11-01.
Infineon's AAGUIDs are shared by every SECORA ID card that runs Infineon's FIDO applet,
whoever sells it. "Only Kyrios devices" is strict only with enterprise attestation or a Kyrios-specific AAGUID.