FCP Public-Key Cryptography in FIDO 4

Question 1

What happens to the FIDO credential key pair when a user performs a factory reset of their authenticator?

Accepted Answer

All stored private keys are permanently destroyed and credentials become unusable

Answer

A factory reset destroys the secure element's contents, permanently deleting all private keys; previously registered credentials must be re-registered.

Question 2

Which field in the FIDO2 PublicKeyCredentialCreationOptions specifies which cryptographic algorithms the relying party will accept?

Accepted Answer

pubKeyCredParams

Answer

The pubKeyCredParams array lists COSE algorithm identifiers (e.g., ES256, RS256) that the relying party is willing to accept.

Question 3

How does the FIDO2 challenge prevent replay attacks during authentication?

Accepted Answer

The server generates a fresh random challenge each session; the authenticator signs it, and the server verifies it was used only once

Answer

A server-generated cryptographic nonce (challenge) that is signed and verified as fresh ensures intercepted assertions cannot be replayed.

Question 4

What is the significance of the signature counter in FIDO U2F and FIDO2 authenticators?

Accepted Answer

It allows relying parties to detect cloned authenticators by identifying non-sequential counter values

Answer

Each authentication increments the counter; a server detecting a lower-than-expected value infers the authenticator may have been cloned.

Question 5

In the context of FIDO attestation, what is 'self attestation' (also called surrogate attestation)?

Accepted Answer

The authenticator uses its credential key pair itself as the attestation key, providing no independent proof of device model

Answer

With self attestation, the credential's own private key signs the attestation, so the relying party gains no additional trust about the authenticator model.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Public-Key Cryptography in FIDO 4