FCP Public-Key Cryptography in FIDO 3

Question 1

During FIDO2 registration, what does the relying party server do with the public key received in the attestation object?

Accepted Answer

Stores it associated with the user account for future assertion verification

Answer

Encrypts it with its own private key and returns it to the authenticator

Answer

Sends it to the FIDO Alliance metadata service for validation

Answer

Discards it and relies only on the credential ID for future logins

Question 2

What security property does using separate key pairs for each relying party provide in FIDO?

Accepted Answer

It prevents user tracking and correlation across different websites

Answer

It allows a single authenticator to support more users simultaneously

Answer

It reduces the computational overhead of signature generation

Answer

It enables offline authentication without network access

Question 3

In FIDO U2F, which cryptographic primitive is used to derive the key handle from the application ID and a device secret?

Accepted Answer

A PRF (Pseudo-Random Function) or HMAC-based key derivation

Answer

RSA-OAEP key encapsulation

Answer

AES-256 symmetric encryption of the private key

Answer

Diffie-Hellman key exchange with the server

Question 4

What does the 'UP' flag in authenticatorData indicate?

Accepted Answer

User Presence was verified — the user physically interacted with the authenticator

Answer

The user has been uniquely identified by biometrics

Answer

The authenticator supports UV (User Verification)

Answer

The credential uses an unprotected (UP) key storage mode

Question 5

Which aspect of asymmetric cryptography allows FIDO to avoid storing any secrets on the relying party server?

Accepted Answer

Only the private key can create valid signatures, so the server holding only the public key has no secret to steal

Answer

The public key can only decrypt data, never encrypt it

Answer

Public keys are ephemeral and change with every authentication

Answer

The server derives the private key on demand using the public key

Question 6

What is 'attestation' in the context of FIDO2 registration?

Accepted Answer

A cryptographic proof that a specific model of authenticator generated the credential

Answer

The process of encrypting the credential public key before sending it to the server

Answer

The server's confirmation that the user's identity has been verified

Answer

The digital signature applied to the user's username during account creation

Question 7

In ECDSA signatures used by FIDO2, what is the mathematical basis that makes the private key computationally infeasible to recover from a signature?

Accepted Answer

The hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP)

Answer

The difficulty of factoring large semiprime integers

Answer

The one-way property of SHA-256 applied to the key material

Answer

The difficulty of solving systems of multivariate polynomial equations