Database Management Flashcards

A FIDO2 relying party experiences a database breach. Which stored credential field poses the greatest risk if exposed to an attacker?

Answer: credential_id

The credential_id, combined with the RP's allowCredentials list, can be used in targeted phishing; however, the public key alone cannot be used to authenticate without the private key on the authenticator.

How should a FIDO2 relying party handle a situation where the received sign_count is less than the stored sign_count?

Answer: Reject authentication and flag the credential as potentially cloned

A decreasing sign_count is a strong indicator of a cloned authenticator; the spec requires the RP to reject the assertion and may revoke the credential.

In a high-availability FIDO2 deployment with read replicas, what risk arises when authentication reads the sign_count from a replica?

Answer: Replication lag may cause a stale sign_count to be used, allowing replay attacks

Replication lag means replicas may have outdated sign_count values, so authentication reads must always target the primary (master) database node.

Which WebAuthn concept defines the database-level scope within which credential_ids must be unique?

Answer: Relying Party ID (rpId)

The rpId scopes credentials, so uniqueness of credential_id is enforced per rpId, not globally across all relying parties.

A FIDO2 credential database schema includes an 'attestation_object' column. Why might the RP choose to persist this binary blob?

Answer: To re-verify attestation at a later time or to support audits requiring proof of authenticator authenticity

Persisting the attestation object allows the RP to re-verify the authenticator's certification status if trust anchors are updated after initial registration.

What is the correct approach to storing FIDO2 credential data when a user has both a platform authenticator and a roaming security key registered?

Answer: Store each as a separate credential record, each with its own credential_id and public key

Each authenticator produces a distinct credential with its own credential_id and key pair; each must be stored as an independent record to support independent authentication.

A FIDO2 relying party must support credential discovery (passkeys). Which database field is essential to return during a discoverable credential assertion flow where no allowCredentials list is sent?

Answer: user_handle

In discoverable flows, the RP receives the user_handle from the authenticator and uses it to look up the user's account without a pre-supplied allowCredentials list.