FCP Security Benefits of FIDO 3 — Questions and Answers
Question 1: What role does the attestation statement play in FIDO's security model during registration?
- It proves the user's identity to the relying party
- It allows the relying party to verify the type and trustworthiness of the authenticator being registered (Correct answer)
- It encrypts the public key in transit to prevent interception
- It binds the credential to the user's email address
Correct answer: It allows the relying party to verify the type and trustworthiness of the authenticator being registered
Attestation allows a relying party to verify that the credential was created by a specific make and model of authenticator with known security properties, enabling policy-based trust decisions.
Question 2: Which FIDO security benefit is most relevant to enterprises concerned about account takeover via social engineering?
- Faster login speeds reduce exposure time
- Phishing resistance means employees cannot be tricked into surrendering usable credentials (Correct answer)
- Biometric data is stored centrally for audit purposes
- Passwords are automatically rotated monthly
Correct answer: Phishing resistance means employees cannot be tricked into surrendering usable credentials
FIDO's phishing resistance means that even if an employee is deceived into visiting a malicious site, the authenticator will not produce a valid response for the attacker's domain.
Question 3: How does FIDO's use of asymmetric cryptography improve security compared to shared-secret (symmetric) approaches?
- Asymmetric keys are longer and therefore more secure
- The server never needs to possess the secret used to prove authentication, eliminating server-side secret exposure (Correct answer)
- Asymmetric encryption is faster and reduces server load
- Symmetric keys require internet connectivity while asymmetric do not
Correct answer: The server never needs to possess the secret used to prove authentication, eliminating server-side secret exposure
With asymmetric cryptography, the private key (the secret) stays on the device; the server only stores the public key, so compromise of the server does not expose authentication secrets.
Question 4: An attacker performs a man-in-the-middle attack, intercepting a FIDO authentication response and immediately replaying it to the relying party. Why does this fail?
- FIDO responses are encrypted with the server's TLS certificate
- Each FIDO response includes a unique challenge signed by the authenticator, making replayed responses invalid (Correct answer)
- The relying party blocks requests from non-whitelisted IP addresses
- FIDO uses session tokens that expire after 30 seconds
Correct answer: Each FIDO response includes a unique challenge signed by the authenticator, making replayed responses invalid
The relying party issues a fresh random challenge for each authentication; the signed response is valid only for that specific challenge, so a replayed response is immediately rejected.
Question 5: What security property does FIDO provide that makes it suitable for regulated industries requiring strong authentication?
- FIDO stores biometric templates on federal servers for compliance auditing
- FIDO provides phishing-resistant, hardware-backed multi-factor authentication meeting NIST AAL3 requirements (Correct answer)
- FIDO guarantees 100% uptime through distributed authentication servers
- FIDO replaces the need for identity proofing during onboarding
Correct answer: FIDO provides phishing-resistant, hardware-backed multi-factor authentication meeting NIST AAL3 requirements
FIDO2 hardware authenticators with user verification can satisfy NIST SP 800-63B Authenticator Assurance Level 3, the highest level, making them suitable for high-value regulated use cases.
Question 6: Why is account recovery a critical security consideration in FIDO deployments?
- Biometric data can degrade and must be refreshed periodically
- Insecure account recovery mechanisms can bypass the strong authentication FIDO provides (Correct answer)
- FIDO authenticators must be re-paired after every password change
- Recovery codes must be stored in the FIDO authenticator's secure enclave
Correct answer: Insecure account recovery mechanisms can bypass the strong authentication FIDO provides
If account recovery falls back to weak factors like email links or security questions, attackers can use those paths to bypass FIDO entirely, undermining the security model.
Question 7: How does FIDO's design reduce the risk associated with large-scale data breaches at major websites?
- FIDO encrypts all user data stored on relying party servers
- Compromised FIDO credential databases contain only public keys, which are useless to attackers for authentication (Correct answer)
- FIDO requires websites to store credentials in geographically distributed vaults
- FIDO mandates real-time breach detection integrated into the authentication flow
Correct answer: Compromised FIDO credential databases contain only public keys, which are useless to attackers for authentication
Because relying parties store only public keys, a breach of their credential database does not yield any information that allows an attacker to authenticate as affected users.
FCP Security Benefits of FIDO 3
What role does the attestation statement play in FIDO's security model during registration?