FCP FIDO Implementation and Deployment Flashcards

Which transport indicator should a server include when registering a USB security key to indicate the communication channel?

Answer: transport: 'usb'

The 'usb' transport indicator specifies that the authenticator communicates via USB, helping the client filter appropriate authenticators during future authentication.

What is the role of the 'aaguid' field in FIDO2 authenticator data?

Answer: A 16-byte identifier for the authenticator model, used to look up metadata

The AAGUID (Authenticator Attestation GUID) identifies the authenticator model (not the individual device), allowing the relying party to look up its metadata and capabilities.

When a relying party receives an authentication assertion, which value must it increment and persist to prevent credential cloning?

Answer: The authenticator's signature counter

The signature counter increments with each authentication; the relying party must verify it is higher than the stored value to detect cloned authenticators.

What does 'enterprise attestation' in FIDO2 allow an organization to do that standard attestation does not?

Answer: Identify individual authenticator devices rather than just models

Enterprise attestation allows organizations to identify individual authenticator devices (not just models), which is useful for asset tracking and compliance in enterprise environments.

Which FIDO2 extension allows a relying party to request a cryptographic proof that the credential is stored in secure hardware?

Answer: credProtect extension

The credProtect extension sets credential protection policies, while device-bound attestation provides hardware storage proof; the uvm extension reports user verification methods used.

In a FIDO2 server implementation, what HTTP response should be returned if the client-side origin does not match the registered rpId?

Answer: 400 Bad Request indicating an origin mismatch

An origin mismatch indicates a potential attack or misconfiguration; the server should return 400 Bad Request since the request itself is malformed relative to the expected registration.