FCP FIDO Protocols and Standards 3 — Questions and Answers
Question 1: Which FIDO2 authenticator transport is defined to operate over Bluetooth Low Energy (BLE) for cross-device authentication scenarios?
- CTAP1/U2F over HID
- CTAP2 over caBLE (Cloud-Assisted BLE) (Correct answer)
- FIDO UAF over NFC
- WebAuthn Level 3 hybrid transport
Correct answer: CTAP2 over caBLE (Cloud-Assisted BLE)
caBLE (Cloud-Assisted BLE), also called the 'hybrid' transport in CTAP2.2, uses BLE proximity combined with a QR code and cloud tunnel to enable cross-device authentication (e.g., phone authenticating a desktop browser).
Question 2: In the WebAuthn specification, what does the 'userHandle' returned in an authentication assertion allow the relying party to do?
- Identify the user account without exposing the username in the credential ID (Correct answer)
- Verify the authenticator's attestation certificate chain
- Determine which CTAP protocol version was used
- Confirm that user presence was verified during authentication
Correct answer: Identify the user account without exposing the username in the credential ID
The userHandle (set during registration as user.id) lets the RP identify which user account the credential belongs to, keeping the credential ID opaque and preventing username enumeration.
Question 3: What is the significance of the 'UP' (User Presence) flag in the FIDO2 authenticatorData flags byte?
- It indicates the authenticator has verified the user's identity via biometrics or PIN
- It confirms that a human physically interacted with the authenticator (e.g., button press) during the operation (Correct answer)
- It signals that the public key credential was created with discoverable credential support
- It marks that the authenticator passed FIDO Level 2 certification
Correct answer: It confirms that a human physically interacted with the authenticator (e.g., button press) during the operation
The UP flag confirms the 'test of user presence' — typically a physical touch or button press — proving a human was physically present, which defends against remote software attacks.
Question 4: Which FIDO Alliance metadata document format provides relying parties with authenticator properties such as AAGUID, supported algorithms, and certification level?
- FIDO Conformance Test Report
- FIDO Metadata Statement (MDS entry) (Correct answer)
- WebAuthn Authenticator Extensions Map
- CTAP Device Info Response
Correct answer: FIDO Metadata Statement (MDS entry)
FIDO Metadata Statements, distributed via the FIDO Metadata Service (MDS), describe each authenticator's properties, supported algorithms, and certification level, allowing RPs to make trust decisions.
Question 5: During a FIDO2 credential creation, what determines whether a credential is stored as a 'server-side credential' versus a 'discoverable credential' (resident key)?
- The attestation conveyance preference in the creation options
- The requireResidentKey or residentKey hint in the authenticatorSelection criteria (Correct answer)
- Whether the authenticator uses CTAP1 or CTAP2 protocol version
- The size of the credential ID returned by the authenticator
Correct answer: The requireResidentKey or residentKey hint in the authenticatorSelection criteria
The authenticatorSelection.requireResidentKey (deprecated) or residentKey field ('required', 'preferred', 'discouraged') tells the authenticator whether to store the private key internally as a discoverable credential.
Question 6: What is 'RP ID' in the context of FIDO2, and what constraint governs its valid values?
- A globally unique UUID assigned by the FIDO Alliance to each relying party
- A domain string that must be a registrable domain suffix of or equal to the origin's effective domain (Correct answer)
- The SHA-256 hash of the relying party's public key certificate
- An arbitrary string chosen by the RP with no domain restrictions
Correct answer: A domain string that must be a registrable domain suffix of or equal to the origin's effective domain
The RP ID must be a valid registrable domain suffix of the origin (e.g., 'example.com' is valid for 'login.example.com'), preventing credential theft across unrelated origins.
Question 7: In FIDO U2F (CTAP1), what is contained in the 'key handle' returned during the registration response?
- The user's public key encrypted with the server's public key
- Authenticator-specific data that allows the device to regenerate or locate the credential private key for that origin (Correct answer)
- A certificate chain linking the device key to the FIDO root CA
- The counter value and user presence byte combined
Correct answer: Authenticator-specific data that allows the device to regenerate or locate the credential private key for that origin
The U2F key handle is an opaque blob (up to 255 bytes) that the authenticator uses to find or reconstruct the private key for a given application ID, and it is passed back to the authenticator during authentication.
FCP FIDO Protocols and Standards 3
Which FIDO2 authenticator transport is defined to operate over Bluetooth Low Energy (BLE) for cross-device authentication scenarios?