FCP System Architecture and Design 3

Question 1

What is the significance of the 'aaguid' field in a FIDO2 authenticator's attestation data?

Accepted Answer

It identifies the make and model of the authenticator, used to look up metadata

Answer

The AAGUID (Authenticator Attestation GUID) identifies the specific model of authenticator, allowing RPs to look up its entry in the FIDO Metadata Service for security properties.

Question 2

Which attestation type in FIDO2 uses a unique per-credential attestation key to preserve user privacy while still proving authenticator model?

Accepted Answer

Anonymization CA Attestation

Answer

Anonymization CA (AnonCA) attestation uses per-credential keys signed by a CA, so the RP cannot link credentials from the same authenticator to each other, preserving privacy.

Question 3

In a FIDO architecture with a Trusted Execution Environment (TEE), what is the primary security boundary that protects FIDO operations?

Accepted Answer

The hardware isolation between the TEE (secure world) and the rich OS (normal world)

Answer

A TEE-based authenticator relies on hardware-enforced isolation between the secure world (TEE) and the normal world (rich OS), so even a compromised OS cannot access FIDO keys.

Question 4

What does 'authenticator binding' mean in the context of FIDO system design?

Accepted Answer

Linking an authenticator's public key to a specific user account on the RP

Answer

Authenticator binding is the process by which the RP associates a user's account with the public key credential produced by a specific authenticator during registration.

Question 5

When a FIDO server validates an authentication assertion, which field in the authenticatorData indicates how many times the authenticator has been used?

Accepted Answer

The 'signCount' field

Answer

The signCount (signature counter) increments each time the authenticator is used, allowing the RP to detect potential cloning by watching for an unexpected counter value.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP System Architecture and Design 3