FCP Public-Key Cryptography in FIDO 3

Question 1

During FIDO2 registration, what does the relying party server do with the public key received in the attestation object?

Accepted Answer

Stores it associated with the user account for future assertion verification

Answer

The relying party stores the credential's public key so it can verify the authenticator's signature during subsequent authentication ceremonies.

Question 2

What security property does using separate key pairs for each relying party provide in FIDO?

Accepted Answer

It prevents user tracking and correlation across different websites

Answer

Per-relying-party key pairs ensure that colluding websites cannot correlate a user's activity by comparing credential identifiers or public keys.

Question 3

In FIDO U2F, which cryptographic primitive is used to derive the key handle from the application ID and a device secret?

Accepted Answer

A PRF (Pseudo-Random Function) or HMAC-based key derivation

Answer

U2F authenticators typically use an HMAC-based KDF with the application ID and an internal secret to deterministically derive key handles.

Question 4

What does the 'UP' flag in authenticatorData indicate?

Accepted Answer

User Presence was verified — the user physically interacted with the authenticator

Answer

The User Presence (UP) flag confirms the authenticator detected a deliberate human gesture, such as touching the device.

Question 5

Which aspect of asymmetric cryptography allows FIDO to avoid storing any secrets on the relying party server?

Accepted Answer

Only the private key can create valid signatures, so the server holding only the public key has no secret to steal

Answer

Because signature verification requires only the public key, servers store no secret material — a database breach exposes only public keys, which are useless to attackers.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Public-Key Cryptography in FIDO 3