FCP System Architecture and Design 3 — Questions and Answers
Question 1: What is the significance of the 'aaguid' field in a FIDO2 authenticator's attestation data?
- It stores the user's unique identifier across all RPs
- It identifies the make and model of the authenticator, used to look up metadata (Correct answer)
- It specifies the cryptographic curve used for key generation
- It contains the hash of the relying party's TLS certificate
Correct answer: It identifies the make and model of the authenticator, used to look up metadata
The AAGUID (Authenticator Attestation GUID) identifies the specific model of authenticator, allowing RPs to look up its entry in the FIDO Metadata Service for security properties.
Question 2: Which attestation type in FIDO2 uses a unique per-credential attestation key to preserve user privacy while still proving authenticator model?
- Full (Basic) Attestation
- Self Attestation
- Anonymization CA Attestation (Correct answer)
- None Attestation
Correct answer: Anonymization CA Attestation
Anonymization CA (AnonCA) attestation uses per-credential keys signed by a CA, so the RP cannot link credentials from the same authenticator to each other, preserving privacy.
Question 3: In a FIDO architecture with a Trusted Execution Environment (TEE), what is the primary security boundary that protects FIDO operations?
- The TLS connection between client and server
- The hardware isolation between the TEE (secure world) and the rich OS (normal world) (Correct answer)
- The PIN or biometric code used to unlock the authenticator
- The HMAC signature on the credential public key
Correct answer: The hardware isolation between the TEE (secure world) and the rich OS (normal world)
A TEE-based authenticator relies on hardware-enforced isolation between the secure world (TEE) and the normal world (rich OS), so even a compromised OS cannot access FIDO keys.
Question 4: What does 'authenticator binding' mean in the context of FIDO system design?
- Linking an authenticator's public key to a specific user account on the RP (Correct answer)
- Pairing two authenticators together for multi-factor use
- Encrypting the authenticator's firmware with the RP's public key
- Registering the authenticator with the FIDO Alliance
Correct answer: Linking an authenticator's public key to a specific user account on the RP
Authenticator binding is the process by which the RP associates a user's account with the public key credential produced by a specific authenticator during registration.
Question 5: When a FIDO server validates an authentication assertion, which field in the authenticatorData indicates how many times the authenticator has been used?
- The 'flags' byte
- The 'signCount' field (Correct answer)
- The 'rpIdHash' field
- The 'credentialId' field
Correct answer: The 'signCount' field
The signCount (signature counter) increments each time the authenticator is used, allowing the RP to detect potential cloning by watching for an unexpected counter value.
Question 6: In the FIDO Metadata Service (MDS), what is a 'status report' used for?
- Reporting individual user authentication attempts to the FIDO Alliance
- Communicating the current security status and any known vulnerabilities of an authenticator model (Correct answer)
- Describing the cryptographic algorithms supported by an authenticator
- Providing the attestation certificate chain for verification
Correct answer: Communicating the current security status and any known vulnerabilities of an authenticator model
Status reports in the MDS communicate the current security posture of an authenticator model, including revocation status and any discovered vulnerabilities, so RPs can make trust decisions.
Question 7: Which FIDO2 extension allows a relying party to request that the authenticator return the large blob storage associated with a credential?
- credProps
- largeBlobKey
- largeBlob (Correct answer)
- prf
Correct answer: largeBlob
The 'largeBlob' extension enables relying parties to store and retrieve up to several kilobytes of opaque data associated with a credential directly on the authenticator.
FCP System Architecture and Design 3
What is the significance of the 'aaguid' field in a FIDO2 authenticator's attestation data?