FCP Database Management 2

Question 1

In a FIDO2 relying party database, what is the correct data type to use for storing a credential's public key?

Accepted Answer

BLOB or BYTEA (binary large object)

Answer

Public keys are binary data and must be stored as a binary large object (BLOB/BYTEA) to preserve byte-exact fidelity.

Question 2

Which field in the FIDO2 credential record uniquely identifies a credential within a specific relying party?

Accepted Answer

credential_id

Answer

The credential_id is the unique identifier assigned by the authenticator that distinguishes each credential at the relying party.

Question 3

A FIDO2 database schema must enforce that the combination of (rpId, credential_id) is unique. What type of constraint achieves this?

Accepted Answer

COMPOSITE UNIQUE constraint

Answer

A composite unique constraint on (rpId, credential_id) ensures no two credentials share the same ID under the same relying party.

Question 4

Why must the sign_count value in a FIDO2 credential record be updated atomically with its validation check?

Accepted Answer

To prevent race conditions that could allow replay attacks

Answer

Atomic read-validate-write of the sign_count prevents concurrent requests from exploiting a window where a replayed assertion could pass.

Question 5

In a FIDO2 credential store, the 'user_handle' is best described as:

Accepted Answer

An opaque byte sequence that maps a credential to a user account

Answer

The user_handle is an opaque, server-generated byte sequence that links a credential to a user without exposing PII to the authenticator.

(FCP) FIDO Certified Professional Practice Test