FCP FIDO Implementation and Deployment Flashcards

Which metadata service should relying parties query to validate authenticator attestations and check for security advisories?

Answer: FIDO Alliance Metadata Service (MDS)

The FIDO Alliance Metadata Service (MDS) provides authenticator metadata including attestation certificates and security status, enabling relying parties to validate attestations.

What is the significance of the 'user verification' flag (UV) in an authenticator data flags byte?

Answer: It indicates the authenticator verified the user locally via biometric or PIN

The UV flag in authenticator data indicates that the authenticator performed local user verification (e.g., biometric or PIN) before completing the ceremony.

When implementing passkeys with cross-device authentication, which protocol enables the phone to communicate with the desktop browser?

Answer: Bluetooth Low Energy (BLE) via CTAP2 hybrid transport

CTAP2 hybrid transport uses BLE for proximity detection and a QR code to bootstrap a secure channel, enabling cross-device authentication for passkeys.

Which CBOR-encoded data structure in FIDO2 carries the credential's public key during registration?

Answer: AuthenticatorAttestationResponse

The AuthenticatorAttestationResponse contains the CBOR-encoded attestation object, which includes the credential's public key in the authData structure.

What is the maximum number of resident keys (discoverable credentials) typically supported by a hardware security key?

Answer: Typically 25–50 credentials depending on the device

Hardware security keys have limited secure storage and typically support 25–50 discoverable (resident) credentials depending on the manufacturer and model.

What does the 'requireResidentKey' (or 'residentKey: required') option in PublicKeyCredentialCreationOptions specify?

Answer: That the credential must be stored on the authenticator as a discoverable credential

Setting residentKey to 'required' instructs the authenticator to store the credential as a discoverable (resident) credential on-device, enabling usernameless login.