Database Management Flashcards

A FIDO2 relying party receives a credential with sign_count=0 during authentication, while the stored sign_count is also 0. Per the WebAuthn spec, the RP should:

Answer: Accept authentication but note the authenticator may not implement counters

A sign_count of 0 from both sides indicates the authenticator does not implement counters; the spec permits acceptance with a logged warning.

Which cryptographic algorithm identifier should the FIDO2 credential database store alongside the public key to correctly verify future assertions?

Answer: COSE algorithm identifier (e.g., -7 for ES256)

The COSE algorithm identifier specifies how the public key must be used for verification, and it must be persisted with the credential record.

In FIDO2 database design, storing the 'transports' array alongside a credential is useful because:

Answer: It allows the RP to suggest the correct authenticator during future authentication

Persisting the transports hint lets the RP call getAllowCredentials with transport hints, improving UX by directing the browser to the right authenticator.

A FIDO2 RP database needs to prevent two concurrent registrations from inserting the same credential_id. Which mechanism is most reliable?

Answer: UNIQUE database constraint on credential_id with transaction rollback on conflict

A database-enforced UNIQUE constraint guarantees atomicity at the storage layer, eliminating race conditions that application locks cannot fully prevent.

Which event should trigger an update to the 'last_used_at' timestamp column in a FIDO2 credential record?

Answer: Successful authentication assertion verification

Updating last_used_at on successful assertion confirms the credential is still in active use and supports policies like revoking dormant credentials.

A FIDO2 server needs to store backup-eligible credential metadata. Which WebAuthn authenticator flag indicates a credential can be backed up?

Answer: BE (Backup Eligibility)

The BE flag in the authenticator data indicates the credential is eligible for cloud backup, which the RP should persist to enforce backup-aware policies.

When designing a FIDO2 credential database for GDPR compliance, how should user_handles be treated?

Answer: Treat them as personal data and ensure they can be deleted on user request

User handles link credentials to user accounts and constitute personal data under GDPR, requiring the ability to delete them upon a subject access or erasure request.