FCP FCP FIDO Implementation and Deployment 2 — Questions and Answers
Question 1: Which metadata service should relying parties query to validate authenticator attestations and check for security advisories?
- NIST National Vulnerability Database
- FIDO Alliance Metadata Service (MDS) (Correct answer)
- Google Safe Browsing API
- Microsoft Azure Attestation Service
Correct answer: FIDO Alliance Metadata Service (MDS)
The FIDO Alliance Metadata Service (MDS) provides authenticator metadata including attestation certificates and security status, enabling relying parties to validate attestations.
Question 2: What is the significance of the 'user verification' flag (UV) in an authenticator data flags byte?
- It confirms the server validated the user's email
- It indicates the authenticator verified the user locally via biometric or PIN (Correct answer)
- It shows the credential was created with attestation
- It signals that backup eligibility is set
Correct answer: It indicates the authenticator verified the user locally via biometric or PIN
The UV flag in authenticator data indicates that the authenticator performed local user verification (e.g., biometric or PIN) before completing the ceremony.
Question 3: When implementing passkeys with cross-device authentication, which protocol enables the phone to communicate with the desktop browser?
- Bluetooth Low Energy (BLE) via CTAP2 hybrid transport (Correct answer)
- NFC tap-to-authenticate
- QR code only over TLS
- Direct Wi-Fi peer-to-peer
Correct answer: Bluetooth Low Energy (BLE) via CTAP2 hybrid transport
CTAP2 hybrid transport uses BLE for proximity detection and a QR code to bootstrap a secure channel, enabling cross-device authentication for passkeys.
Question 4: Which CBOR-encoded data structure in FIDO2 carries the credential's public key during registration?
- AuthenticatorAssertionResponse
- AuthenticatorAttestationResponse (Correct answer)
- CollectedClientData
- TokenBinding
Correct answer: AuthenticatorAttestationResponse
The AuthenticatorAttestationResponse contains the CBOR-encoded attestation object, which includes the credential's public key in the authData structure.
Question 5: What is the maximum number of resident keys (discoverable credentials) typically supported by a hardware security key?
- Unlimited, stored in cloud backup
- Typically 25–50 credentials depending on the device (Correct answer)
- Exactly 1 credential per site
- 10,000 credentials via extended memory
Correct answer: Typically 25–50 credentials depending on the device
Hardware security keys have limited secure storage and typically support 25–50 discoverable (resident) credentials depending on the manufacturer and model.
Question 6: What does the 'requireResidentKey' (or 'residentKey: required') option in PublicKeyCredentialCreationOptions specify?
- That the credential must be backed up to the cloud
- That the credential must be stored on the authenticator as a discoverable credential (Correct answer)
- That user verification is mandatory
- That the credential cannot be exported
Correct answer: That the credential must be stored on the authenticator as a discoverable credential
Setting residentKey to 'required' instructs the authenticator to store the credential as a discoverable (resident) credential on-device, enabling usernameless login.
FCP FCP FIDO Implementation and Deployment 2
Which metadata service should relying parties query to validate authenticator attestations and check for security advisories?