FCP FIDO Implementation and Deployment Flashcards

When deploying a FIDO2 relying party, which origin binding mechanism ensures that credentials cannot be used on phishing sites?

Answer: The rpId bound to the registered domain origin

FIDO2 binds credentials to the relying party ID (rpId), which is tied to the origin domain, making phishing impossible because credentials are cryptographically tied to the legitimate site.

Which attestation type provides the strongest assurance that an authenticator is genuine and meets specific security requirements during registration?

Answer: Full (basic) attestation

Full (basic) attestation uses a manufacturer-issued certificate chain to cryptographically prove the authenticator's make and model, providing the strongest assurance of device authenticity.

What is the recommended approach for storing FIDO2 credential public keys on a relying party server?

Answer: Store them in a database associated with the user account

FIDO2 public keys must be stored server-side in a database associated with the user account so the relying party can verify authentication assertions.

Which FIDO2 client-side JavaScript API method initiates the credential creation ceremony?

Answer: navigator.credentials.create()

navigator.credentials.create() is the WebAuthn API call used to initiate the FIDO2 registration ceremony and create a new credential.

During FIDO2 registration, what is the purpose of the 'challenge' parameter provided by the relying party?

Answer: To prevent replay attacks by ensuring each registration is unique

The challenge is a random nonce that prevents replay attacks by ensuring the authenticator signs a unique value for each registration or authentication ceremony.

What should a relying party do if it receives a FIDO2 attestation with 'none' attestation format?

Answer: Accept it only if the use case does not require authenticator verification

None attestation provides no information about the authenticator; relying parties should accept it only when strong authenticator verification is not required by their security policy.