FCP System Architecture and Design 2

Question 1

In a FIDO2 architecture, which component is responsible for storing and managing the cryptographic keys used for authentication?

Accepted Answer

The Authenticator

Answer

The authenticator generates, stores, and manages the private keys used in FIDO2 authentication, ensuring they never leave the device.

Question 2

What is the role of the 'client data hash' in the FIDO2 WebAuthn authentication flow?

Accepted Answer

It binds the authentication assertion to a specific challenge and origin

Answer

The client data hash (SHA-256 of clientDataJSON) binds the authenticator's signature to the specific challenge and origin, preventing replay attacks.

Question 3

Which FIDO architecture pattern uses a separate dedicated security chip to isolate cryptographic operations from the main processor?

Accepted Answer

Discrete Authenticator Pattern

Answer

The Discrete Authenticator Pattern uses a separate dedicated hardware chip (like a TPM or secure element) physically isolated from the main CPU.

Question 4

In FIDO UAF, what does 'Transaction Confirmation' allow an authenticator to do?

Accepted Answer

Display transaction details to the user and bind them cryptographically to the authentication

Answer

Transaction Confirmation allows the authenticator to display transaction details and include them in the signed response, ensuring the user explicitly approves the specific transaction.

Question 5

When designing a FIDO deployment, what is the primary purpose of 'appID' in UAF and 'rpId' in FIDO2?

Accepted Answer

To specify the scope of credentials and bind them to a specific service

Answer

The appID (UAF) and rpId (FIDO2) define the scope of credentials, binding them to a specific origin or set of origins so credentials cannot be used across unrelated services.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP System Architecture and Design 2