FCP Data Structures and Algorithms 3

Question 1

FIDO2 credential public keys are encoded using the COSE_Key structure. Which map key integer represents the key type (kty) parameter?

Accepted Answer

1

Answer

In COSE_Key (RFC 8152), integer key 1 maps to the 'kty' (key type) parameter identifying whether the key is EC2, RSA, OKP, etc.

Question 2

Which graph traversal algorithm is conceptually used when a FIDO2 client validates an attestation certificate chain up to a trusted root CA?

Accepted Answer

Breadth-first search from leaf to root

Answer

Certificate chain validation traverses from the leaf (attestation certificate) upward via BFS-like hops to a trusted root, verifying each issuer-subject link.

Question 3

In FIDO metadata (MDS3), authenticator metadata entries are aggregated in a JWT whose payload contains a list. What is the algorithmic advantage of sorting this list by AAGUID?

Accepted Answer

Enables O(log n) binary search for a specific authenticator entry

Answer

A sorted list of entries allows O(log n) binary search when a relying party needs to look up metadata for a specific AAGUID.

Question 4

What data structure does a FIDO2 relying party maintain to prevent credential replay by tracking which assertion challenge nonces have been consumed?

Accepted Answer

Bloom filter or set of used challenge values with TTL

Answer

Relying parties use a set (often with TTL expiry) or Bloom filter to record consumed challenges and reject any replayed assertion that reuses a nonce.

Question 5

The HMAC-Secret extension in FIDO2 uses HMAC with which underlying hash to derive secrets from a salt and the authenticator's device-bound key?

Accepted Answer

SHA-256

Answer

The HMAC-Secret extension specifies HMAC-SHA-256 to derive output secrets from the provided salts and the per-credential HMAC secret key.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Data Structures and Algorithms 3