FCP FIDO Authentication Methods 2 — Questions and Answers
Question 1: Which cryptographic operation does a FIDO2 authenticator perform during the authentication ceremony?
- It encrypts the user's password with a public key
- It signs the authenticatorData and clientDataHash with the credential's private key (Correct answer)
- It transmits a shared symmetric key to the relying party
- It hashes the user's biometric template and sends it to the server
Correct answer: It signs the authenticatorData and clientDataHash with the credential's private key
During FIDO2 authentication, the authenticator signs the concatenation of authenticatorData and clientDataHash using the credential's private key, producing an assertion signature.
Question 2: What is the purpose of the 'up' (user presence) flag in the authenticatorData structure?
- It indicates the user's physical location was verified
- It signals that a test of user presence was performed, such as a button press (Correct answer)
- It confirms that user verification (PIN or biometric) was completed
- It records whether the user is currently online
Correct answer: It signals that a test of user presence was performed, such as a button press
The 'up' flag in authenticatorData indicates that the authenticator performed a test of user presence, typically a physical touch or button press.
Question 3: A roaming authenticator connected via NFC is used to authenticate to a website. Which transport is being used?
- USB HID
- BLE
- NFC (Correct answer)
- CTAP over TLS
Correct answer: NFC
NFC (Near Field Communication) is one of the defined CTAP transports for roaming authenticators communicating with a client platform.
Question 4: What differentiates a 'second-factor' (U2F-style) flow from a 'first-factor' passwordless flow in FIDO?
- Second-factor requires attestation; passwordless does not
- Passwordless requires user verification (UV) at the authenticator; second-factor requires only user presence (Correct answer)
- Second-factor uses CTAP2; passwordless uses CTAP1
- Passwordless always uses platform authenticators; second-factor uses roaming authenticators
Correct answer: Passwordless requires user verification (UV) at the authenticator; second-factor requires only user presence
In a passwordless first-factor flow the authenticator must perform user verification (PIN, biometric) to replace the password, whereas U2F-style second-factor flows require only user presence.
Question 5: Which field in a WebAuthn PublicKeyCredentialRequestOptions limits which credentials are acceptable during authentication?
- excludeCredentials
- allowCredentials (Correct answer)
- userVerification
- rpId
Correct answer: allowCredentials
The 'allowCredentials' field contains a list of credential descriptors that the relying party will accept during an authentication ceremony.
Question 6: During FIDO registration, what does the relying party do with the attestation statement?
- It discards it immediately to protect user privacy
- It verifies it to establish trust in the authenticator model and its properties (Correct answer)
- It forwards it to the FIDO Alliance for auditing
- It stores it as the user's credential ID for future authentication
Correct answer: It verifies it to establish trust in the authenticator model and its properties
The relying party verifies the attestation statement to determine the trustworthiness and properties of the authenticator model being registered.
Question 7: What is a 'resident key' (discoverable credential) in FIDO2, and why is it required for usernameless flows?
- A key stored in the relying party's database, required because the server must look it up
- A credential stored on the authenticator indexed by rpId and user handle, enabling authentication without a username prompt (Correct answer)
- A hardware-backed key that cannot be exported, required for high-assurance scenarios
- A key shared between the authenticator and client platform, required for platform authenticators
Correct answer: A credential stored on the authenticator indexed by rpId and user handle, enabling authentication without a username prompt
A discoverable credential (resident key) is stored on the authenticator itself keyed by rpId and user handle, allowing the authenticator to present it without the server first providing a credential list.
FCP FIDO Authentication Methods 2
Which cryptographic operation does a FIDO2 authenticator perform during the authentication ceremony?