FCP FCP FIDO Implementation and Deployment 1 — Questions and Answers
Question 1: When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?
- Cookie-based session tokens
- The rpId bound to the registered domain origin (Correct answer)
- IP address allowlisting
- TLS certificate pinning only
Correct answer: The rpId bound to the registered domain origin
FIDO2 binds credentials to the relying party ID (rpId), which is tied to the origin domain, making phishing impossible because credentials are cryptographically tied to the legitimate site.
Question 2: Which attestation type provides the strongest assurance that an authenticator is genuine and meets specific security requirements during registration?
- None attestation
- Self attestation
- Full (basic) attestation (Correct answer)
- Surrogate attestation
Correct answer: Full (basic) attestation
Full (basic) attestation uses a manufacturer-issued certificate chain to cryptographically prove the authenticator's make and model, providing the strongest assurance of device authenticity.
Question 3: What is the recommended approach for storing FIDO2 credential public keys on a relying party server?
- Encrypt them with AES-256 and store in a flat file
- Store them in a database associated with the user account (Correct answer)
- Keep them only in browser local storage
- Hash them with bcrypt before storing
Correct answer: Store them in a database associated with the user account
FIDO2 public keys must be stored server-side in a database associated with the user account so the relying party can verify authentication assertions.
Question 4: Which FIDO2 client-side JavaScript API method initiates the credential creation ceremony?
- navigator.credentials.get()
- navigator.credentials.create() (Correct answer)
- window.fido.register()
- navigator.webauthn.create()
Correct answer: navigator.credentials.create()
navigator.credentials.create() is the WebAuthn API call used to initiate the FIDO2 registration ceremony and create a new credential.
Question 5: During FIDO2 registration, what is the purpose of the 'challenge' parameter provided by the relying party?
- To identify the user account
- To prevent replay attacks by ensuring each registration is unique (Correct answer)
- To specify the allowed authenticator types
- To set the credential timeout value
Correct answer: To prevent replay attacks by ensuring each registration is unique
The challenge is a random nonce that prevents replay attacks by ensuring the authenticator signs a unique value for each registration or authentication ceremony.
Question 6: What should a relying party do if it receives a FIDO2 attestation with 'none' attestation format?
- Reject the registration as insecure
- Accept it only if the use case does not require authenticator verification (Correct answer)
- Always accept it as the default format
- Request re-registration with a different authenticator
Correct answer: Accept it only if the use case does not require authenticator verification
None attestation provides no information about the authenticator; relying parties should accept it only when strong authenticator verification is not required by their security policy.
FCP FCP FIDO Implementation and Deployment 1
When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?