FCP Security Benefits of FIDO 3

Question 1

What role does the attestation statement play in FIDO's security model during registration?

Accepted Answer

It allows the relying party to verify the type and trustworthiness of the authenticator being registered

Answer

Attestation allows a relying party to verify that the credential was created by a specific make and model of authenticator with known security properties, enabling policy-based trust decisions.

Question 2

Which FIDO security benefit is most relevant to enterprises concerned about account takeover via social engineering?

Accepted Answer

Phishing resistance means employees cannot be tricked into surrendering usable credentials

Answer

FIDO's phishing resistance means that even if an employee is deceived into visiting a malicious site, the authenticator will not produce a valid response for the attacker's domain.

Question 3

How does FIDO's use of asymmetric cryptography improve security compared to shared-secret (symmetric) approaches?

Accepted Answer

The server never needs to possess the secret used to prove authentication, eliminating server-side secret exposure

Answer

With asymmetric cryptography, the private key (the secret) stays on the device; the server only stores the public key, so compromise of the server does not expose authentication secrets.

Question 4

An attacker performs a man-in-the-middle attack, intercepting a FIDO authentication response and immediately replaying it to the relying party. Why does this fail?

Accepted Answer

Each FIDO response includes a unique challenge signed by the authenticator, making replayed responses invalid

Answer

The relying party issues a fresh random challenge for each authentication; the signed response is valid only for that specific challenge, so a replayed response is immediately rejected.

Question 5

What security property does FIDO provide that makes it suitable for regulated industries requiring strong authentication?

Accepted Answer

FIDO provides phishing-resistant, hardware-backed multi-factor authentication meeting NIST AAL3 requirements

Answer

FIDO2 hardware authenticators with user verification can satisfy NIST SP 800-63B Authenticator Assurance Level 3, the highest level, making them suitable for high-value regulated use cases.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Security Benefits of FIDO 3