FCP FIDO Authentication Methods 3 — Questions and Answers
Question 1: Which FIDO2 extension allows an authenticator to report the method used for user verification (e.g., fingerprint vs. PIN)?
- txAuthSimple
- uvm (User Verification Method) (Correct answer)
- credProtect
- hmac-secret
Correct answer: uvm (User Verification Method)
The 'uvm' extension returns a matrix of user verification method descriptors indicating how the authenticator performed UV during the ceremony.
Question 2: An enterprise requires that only authenticators with FIPS 140-2 Level 3 certification are trusted. Which FIDO mechanism enables enforcement of this policy?
- Checking the 'uv' flag in authenticatorData
- Using metadata from the FIDO Metadata Service (MDS) to filter by authenticator certification level (Correct answer)
- Requiring the 'credProtect' extension level 3
- Enforcing PIN complexity via CTAP clientPin command
Correct answer: Using metadata from the FIDO Metadata Service (MDS) to filter by authenticator certification level
The FIDO Metadata Service (MDS) publishes authenticator metadata including certification levels, enabling relying parties to accept or reject authenticators based on those properties.
Question 3: What is the 'counter' value in authenticatorData used for?
- Tracking the number of registered credentials on the authenticator
- Detecting cloned authenticators by identifying unexpected decreases or repeated values (Correct answer)
- Counting failed PIN attempts to enforce lockout
- Measuring the time elapsed since the credential was created
Correct answer: Detecting cloned authenticators by identifying unexpected decreases or repeated values
Each authentication increments the authenticator's signature counter; if the relying party receives a counter value not greater than the stored value, it may indicate a cloned authenticator.
Question 4: Which CTAP2 command is used by a client platform to request a new credential from a roaming authenticator?
- authenticatorGetAssertion
- authenticatorMakeCredential (Correct answer)
- authenticatorClientPIN
- authenticatorGetInfo
Correct answer: authenticatorMakeCredential
The authenticatorMakeCredential CTAP2 command instructs the authenticator to generate a new public-key credential pair and return the attestation object.
Question 5: A user registers a FIDO2 security key on a laptop, then attempts to use it on a different laptop. Which statement is true?
- Registration must be repeated on the second laptop because credentials are bound to the client platform
- The roaming authenticator can be used on any platform because the credential is stored on the key itself (Correct answer)
- The user must re-enroll their biometric on the second laptop
- Cross-platform use requires the relying party to issue a new challenge
Correct answer: The roaming authenticator can be used on any platform because the credential is stored on the key itself
Roaming authenticators store the credential (or the key material to derive it) internally, making them portable across any compliant client platform.
Question 6: What does the 'rk' (resident key) option set to 'required' in CTAP2 makeCredential instruct the authenticator to do?
- Use the device's root key for signing instead of a per-credential key
- Store the credential on the authenticator's internal storage so it can be discovered without a credential list (Correct answer)
- Require the relying party to provide a PIN before accepting the credential
- Encrypt the credential ID using a hardware-backed key
Correct answer: Store the credential on the authenticator's internal storage so it can be discovered without a credential list
When 'rk' is required, the authenticator stores the full credential (including user handle) internally, enabling discoverable/resident credential flows.
Question 7: In the WebAuthn specification, what is the 'clientDataJSON' and why is it included in the signed data?
- A JSON blob containing the user's profile, signed to prove identity
- A JSON structure encoding the challenge, origin, and type, bound to the authenticator signature to prevent replay and phishing (Correct answer)
- A JSON object storing the credential's public key returned to the relying party
- A metadata file describing the authenticator's capabilities sent alongside attestation
Correct answer: A JSON structure encoding the challenge, origin, and type, bound to the authenticator signature to prevent replay and phishing
clientDataJSON encodes the challenge (preventing replay), the origin (preventing phishing), and the operation type, and its hash is included in the authenticator's signature to cryptographically bind the operation context.
FCP FIDO Authentication Methods 3
Which FIDO2 extension allows an authenticator to report the method used for user verification (e.g., fingerprint vs.
PIN)?