FCP Public-Key Cryptography in FIDO 3 — Questions and Answers
Question 1: During FIDO2 registration, what does the relying party server do with the public key received in the attestation object?
- Encrypts it with its own private key and returns it to the authenticator
- Stores it associated with the user account for future assertion verification (Correct answer)
- Sends it to the FIDO Alliance metadata service for validation
- Discards it and relies only on the credential ID for future logins
Correct answer: Stores it associated with the user account for future assertion verification
The relying party stores the credential's public key so it can verify the authenticator's signature during subsequent authentication ceremonies.
Question 2: What security property does using separate key pairs for each relying party provide in FIDO?
- It allows a single authenticator to support more users simultaneously
- It prevents user tracking and correlation across different websites (Correct answer)
- It reduces the computational overhead of signature generation
- It enables offline authentication without network access
Correct answer: It prevents user tracking and correlation across different websites
Per-relying-party key pairs ensure that colluding websites cannot correlate a user's activity by comparing credential identifiers or public keys.
Question 3: In FIDO U2F, which cryptographic primitive is used to derive the key handle from the application ID and a device secret?
- RSA-OAEP key encapsulation
- A PRF (Pseudo-Random Function) or HMAC-based key derivation (Correct answer)
- AES-256 symmetric encryption of the private key
- Diffie-Hellman key exchange with the server
Correct answer: A PRF (Pseudo-Random Function) or HMAC-based key derivation
U2F authenticators typically use an HMAC-based KDF with the application ID and an internal secret to deterministically derive key handles.
Question 4: What does the 'UP' flag in authenticatorData indicate?
- The user has been uniquely identified by biometrics
- User Presence was verified — the user physically interacted with the authenticator (Correct answer)
- The authenticator supports UV (User Verification)
- The credential uses an unprotected (UP) key storage mode
Correct answer: User Presence was verified — the user physically interacted with the authenticator
The User Presence (UP) flag confirms the authenticator detected a deliberate human gesture, such as touching the device.
Question 5: Which aspect of asymmetric cryptography allows FIDO to avoid storing any secrets on the relying party server?
- The public key can only decrypt data, never encrypt it
- Only the private key can create valid signatures, so the server holding only the public key has no secret to steal (Correct answer)
- Public keys are ephemeral and change with every authentication
- The server derives the private key on demand using the public key
Correct answer: Only the private key can create valid signatures, so the server holding only the public key has no secret to steal
Because signature verification requires only the public key, servers store no secret material — a database breach exposes only public keys, which are useless to attackers.
Question 6: What is 'attestation' in the context of FIDO2 registration?
- The process of encrypting the credential public key before sending it to the server
- A cryptographic proof that a specific model of authenticator generated the credential (Correct answer)
- The server's confirmation that the user's identity has been verified
- The digital signature applied to the user's username during account creation
Correct answer: A cryptographic proof that a specific model of authenticator generated the credential
Attestation provides a verifiable statement about the authenticator's hardware/firmware characteristics, signed by the device manufacturer.
Question 7: In ECDSA signatures used by FIDO2, what is the mathematical basis that makes the private key computationally infeasible to recover from a signature?
- The difficulty of factoring large semiprime integers
- The hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP) (Correct answer)
- The one-way property of SHA-256 applied to the key material
- The difficulty of solving systems of multivariate polynomial equations
Correct answer: The hardness of the Elliptic Curve Discrete Logarithm Problem (ECDLP)
ECDSA security relies on the ECDLP: given a point Q = k·G on the curve, it is computationally infeasible to recover the scalar k (private key).
FCP Public-Key Cryptography in FIDO 3
During FIDO2 registration, what does the relying party server do with the public key received in the attestation object?