FCP Data Structures and Algorithms 2 — Questions and Answers
Question 1: Which data structure does the FIDO2 authenticator use to store the counter value that prevents replay attacks?
- A monotonically increasing integer stored in non-volatile memory (Correct answer)
- A hash table mapping credential IDs to timestamps
- A circular buffer of recent nonces
- A Merkle tree of transaction logs
Correct answer: A monotonically increasing integer stored in non-volatile memory
FIDO2 authenticators maintain a monotonically increasing signature counter in persistent (non-volatile) memory to detect cloned authenticators.
Question 2: In FIDO's CTAP2 protocol, what encoding format is used to serialize data structures for transmission between the authenticator and the platform?
- JSON
- CBOR (Concise Binary Object Representation) (Correct answer)
- XML
- Protocol Buffers
Correct answer: CBOR (Concise Binary Object Representation)
CTAP2 uses CBOR for compact binary serialization of authenticator request and response data structures.
Question 3: What algorithmic technique does FIDO2's authenticatorGetInfo command use to enumerate supported algorithms in a defined priority order?
- A min-heap sorted by security level
- An ordered array (list) where earlier entries have higher priority (Correct answer)
- A sorted set keyed by COSE algorithm identifier
- A linked list traversed by relying party preference
Correct answer: An ordered array (list) where earlier entries have higher priority
CTAP2 specifies that the algorithms array in authenticatorGetInfo is ordered so that entries earlier in the list are preferred by the authenticator.
Question 4: Which tree-based data structure is commonly used by platform authenticators to efficiently look up stored credentials by Relying Party ID?
- B-tree or B+ tree index (Correct answer)
- Unordered linked list
- Stack
- Circular queue
Correct answer: B-tree or B+ tree index
Platform credential stores typically use B-tree or B+ tree indices to provide O(log n) lookup of credentials by RP ID.
Question 5: In the FIDO2 WebAuthn spec, the clientDataJSON object is serialized and then processed by which algorithm before being included in the signed authenticatorData?
- AES-128 encryption
- SHA-256 hashing (Correct answer)
- HMAC-SHA1
- Base64url encoding only
Correct answer: SHA-256 hashing
The client hashes the clientDataJSON using SHA-256, and that hash is concatenated with authenticatorData before the authenticator signs it.
Question 6: What is the time complexity of verifying a credential ID lookup in a FIDO2 platform authenticator that indexes credentials in a hash map by credential ID?
- O(n)
- O(n log n)
- O(1) average case (Correct answer)
- O(log n)
Correct answer: O(1) average case
Hash map lookups are O(1) average case, making credential ID verification fast regardless of the number of stored credentials.
Question 7: Which FIDO2 data structure carries the AAGUID, credential ID, and public key together in a single attestation object field?
- attestationStatement
- authData (authenticatorData) (Correct answer)
- clientDataJSON
- tokenBinding
Correct answer: authData (authenticatorData)
The authenticatorData (authData) field contains the AAGUID, credential ID length, credential ID, and the credential public key in COSE format.
FCP Data Structures and Algorithms 2
Which data structure does the FIDO2 authenticator use to store the counter value that prevents replay attacks?