FCP FIDO Protocols and Standards 3

Question 1

Which FIDO2 authenticator transport is defined to operate over Bluetooth Low Energy (BLE) for cross-device authentication scenarios?

Accepted Answer

CTAP2 over caBLE (Cloud-Assisted BLE)

Answer

caBLE (Cloud-Assisted BLE), also called the 'hybrid' transport in CTAP2.2, uses BLE proximity combined with a QR code and cloud tunnel to enable cross-device authentication (e.g., phone authenticating a desktop browser).

Question 2

In the WebAuthn specification, what does the 'userHandle' returned in an authentication assertion allow the relying party to do?

Accepted Answer

Identify the user account without exposing the username in the credential ID

Answer

The userHandle (set during registration as user.id) lets the RP identify which user account the credential belongs to, keeping the credential ID opaque and preventing username enumeration.

Question 3

What is the significance of the 'UP' (User Presence) flag in the FIDO2 authenticatorData flags byte?

Accepted Answer

It confirms that a human physically interacted with the authenticator (e.g., button press) during the operation

Answer

The UP flag confirms the 'test of user presence' — typically a physical touch or button press — proving a human was physically present, which defends against remote software attacks.

Question 4

Which FIDO Alliance metadata document format provides relying parties with authenticator properties such as AAGUID, supported algorithms, and certification level?

Accepted Answer

FIDO Metadata Statement (MDS entry)

Answer

FIDO Metadata Statements, distributed via the FIDO Metadata Service (MDS), describe each authenticator's properties, supported algorithms, and certification level, allowing RPs to make trust decisions.

Question 5

During a FIDO2 credential creation, what determines whether a credential is stored as a 'server-side credential' versus a 'discoverable credential' (resident key)?

Accepted Answer

The requireResidentKey or residentKey hint in the authenticatorSelection criteria

Answer

The authenticatorSelection.requireResidentKey (deprecated) or residentKey field ('required', 'preferred', 'discouraged') tells the authenticator whether to store the private key internally as a discoverable credential.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP FIDO Protocols and Standards 3