FCP System Architecture and Design 2 — Questions and Answers
Question 1: In a FIDO2 architecture, which component is responsible for storing and managing the cryptographic keys used for authentication?
- The Relying Party Server
- The FIDO Server
- The Authenticator (Correct answer)
- The Client Platform
Correct answer: The Authenticator
The authenticator generates, stores, and manages the private keys used in FIDO2 authentication, ensuring they never leave the device.
Question 2: What is the role of the 'client data hash' in the FIDO2 WebAuthn authentication flow?
- It encrypts the user's credential ID
- It binds the authentication assertion to a specific challenge and origin (Correct answer)
- It identifies the authenticator model to the server
- It stores the user's display name for verification
Correct answer: It binds the authentication assertion to a specific challenge and origin
The client data hash (SHA-256 of clientDataJSON) binds the authenticator's signature to the specific challenge and origin, preventing replay attacks.
Question 3: Which FIDO architecture pattern uses a separate dedicated security chip to isolate cryptographic operations from the main processor?
- Bound Authenticator Pattern
- TEE-based Authenticator Pattern
- Discrete Authenticator Pattern (Correct answer)
- Software Authenticator Pattern
Correct answer: Discrete Authenticator Pattern
The Discrete Authenticator Pattern uses a separate dedicated hardware chip (like a TPM or secure element) physically isolated from the main CPU.
Question 4: In FIDO UAF, what does 'Transaction Confirmation' allow an authenticator to do?
- Verify the user's identity against a central database
- Display transaction details to the user and bind them cryptographically to the authentication (Correct answer)
- Confirm the transaction with a secondary authenticator
- Send an OTP to the user's registered phone number
Correct answer: Display transaction details to the user and bind them cryptographically to the authentication
Transaction Confirmation allows the authenticator to display transaction details and include them in the signed response, ensuring the user explicitly approves the specific transaction.
Question 5: When designing a FIDO deployment, what is the primary purpose of 'appID' in UAF and 'rpId' in FIDO2?
- To uniquely identify individual users across sessions
- To specify the scope of credentials and bind them to a specific service (Correct answer)
- To indicate the authenticator's attestation certificate chain
- To define the cryptographic algorithm used during registration
Correct answer: To specify the scope of credentials and bind them to a specific service
The appID (UAF) and rpId (FIDO2) define the scope of credentials, binding them to a specific origin or set of origins so credentials cannot be used across unrelated services.
Question 6: What is 'attestation conveyance' in FIDO2 WebAuthn, and which mode sends no attestation information?
- A process to verify user identity; 'indirect' mode sends no attestation
- A mechanism for the authenticator to prove its model/type; 'none' conveyance sends no attestation (Correct answer)
- A method for the RP to verify the server certificate; 'direct' mode skips this
- A process for key exchange; 'enterprise' mode suppresses attestation
Correct answer: A mechanism for the authenticator to prove its model/type; 'none' conveyance sends no attestation
Attestation conveyance is the mechanism by which an authenticator proves its model and properties to the RP; the 'none' conveyance preference results in no attestation statement being sent.
Question 7: In a multi-server FIDO deployment, what mechanism ensures a credential registered on one server instance can be authenticated by another instance?
- Credential ID replication via DNS
- Shared credential storage backed by a centralized or synchronized database (Correct answer)
- Re-registration on each server instance during user login
- Broadcasting the public key over a multicast network
Correct answer: Shared credential storage backed by a centralized or synchronized database
A centralized or synchronized credential store allows any server instance to retrieve the user's public key and credential metadata, enabling authentication regardless of which instance handles the request.
FCP System Architecture and Design 2
In a FIDO2 architecture, which component is responsible for storing and managing the cryptographic keys used for authentication?