FCP Testing and Quality Assurance 3 — Questions and Answers
Question 1: In FIDO conformance testing, what does the 'packed' attestation format test specifically verify?
- That the signature over authenticatorData and clientDataHash uses the attested credential's key or a batch key (Correct answer)
- That the credential counter starts at zero
- That the AAGUID matches the metadata statement
- That the transport hint includes USB
Correct answer: That the signature over authenticatorData and clientDataHash uses the attested credential's key or a batch key
Packed attestation tests verify the signature covers authenticatorData concatenated with clientDataHash using either a per-credential or batch attestation key.
Question 2: Which metric is most important when performing load testing on a FIDO2 server's assertion endpoint?
- Signature verification latency under concurrent authentication requests (Correct answer)
- Number of attestation formats supported
- Average credential counter increment rate
- CBOR decoding throughput for registration only
Correct answer: Signature verification latency under concurrent authentication requests
Assertion endpoints under load must maintain low signature verification latency, as this is the cryptographic bottleneck during concurrent authentications.
Question 3: A tester is validating UV (user verification) behavior. The relying party sets userVerification to 'required' but the authenticator returns the UV flag as 0. What is the correct server response?
- Reject the assertion with an error because user verification was required but not performed (Correct answer)
- Accept the assertion since user presence is still confirmed
- Downgrade to U2F mode automatically
- Request a second factor from the user
Correct answer: Reject the assertion with an error because user verification was required but not performed
When userVerification is 'required', the server must reject any assertion where the UV flag is not set, as user verification did not occur.
Question 4: What is the correct test to verify replay attack protection in a FIDO2 server implementation?
- Submit the same valid assertion response twice and confirm the server rejects the second attempt (Correct answer)
- Check that the challenge is at least 16 bytes long
- Verify that clientDataJSON includes the crossOrigin field
- Confirm the attestation certificate has not expired
Correct answer: Submit the same valid assertion response twice and confirm the server rejects the second attempt
Replay protection is validated by submitting a previously successful assertion a second time and verifying the server rejects it, typically by tracking used challenges or credential counters.
Question 5: During testing of the credential counter, a QA engineer observes the authenticator returns a counter value lower than the last stored value. What should a FIDO2-compliant server do?
- Flag the credential as potentially cloned and refuse the authentication (Correct answer)
- Accept the assertion but log a warning
- Reset the counter to the new value and continue
- Request re-registration of the credential
Correct answer: Flag the credential as potentially cloned and refuse the authentication
A decreasing counter is a sign of a cloned authenticator; FIDO2 servers must treat this as a security error and refuse authentication.
Question 6: When testing FIDO UAF client-to-ASM (Authenticator-Specific Module) communication, which interface is being exercised?
- The UAF Client API defined in the UAF Authenticator Transport Binding specification (Correct answer)
- The CTAP2 protocol over USB HID
- The WebAuthn Level 2 JavaScript API
- The FIDO metadata service REST endpoint
Correct answer: The UAF Client API defined in the UAF Authenticator Transport Binding specification
UAF client-to-ASM communication is governed by the UAF Authenticator Transport Binding specification, which defines how the client communicates with authenticator modules.
Question 7: A QA tester is verifying that a FIDO2 server correctly handles the 'none' attestation format. What is the expected server behavior when attestation is 'none' but the relying party requires direct attestation?
- The server should reject the registration because the required attestation was not provided (Correct answer)
- The server should accept 'none' attestation as a fallback for all policies
- The server should request a new registration with a different authenticator
- The server should query the FIDO metadata service for the missing attestation
Correct answer: The server should reject the registration because the required attestation was not provided
If a relying party requires 'direct' or 'enterprise' attestation, receiving 'none' attestation must result in rejection of the registration.
FCP Testing and Quality Assurance 3
In FIDO conformance testing, what does the 'packed' attestation format test specifically verify?