FCP Testing and Quality Assurance 3

Question 1

In FIDO conformance testing, what does the 'packed' attestation format test specifically verify?

Accepted Answer

That the signature over authenticatorData and clientDataHash uses the attested credential's key or a batch key

Answer

Packed attestation tests verify the signature covers authenticatorData concatenated with clientDataHash using either a per-credential or batch attestation key.

Question 2

Which metric is most important when performing load testing on a FIDO2 server's assertion endpoint?

Accepted Answer

Signature verification latency under concurrent authentication requests

Answer

Assertion endpoints under load must maintain low signature verification latency, as this is the cryptographic bottleneck during concurrent authentications.

Question 3

A tester is validating UV (user verification) behavior. The relying party sets userVerification to 'required' but the authenticator returns the UV flag as 0. What is the correct server response?

Accepted Answer

Reject the assertion with an error because user verification was required but not performed

Answer

When userVerification is 'required', the server must reject any assertion where the UV flag is not set, as user verification did not occur.

Question 4

What is the correct test to verify replay attack protection in a FIDO2 server implementation?

Accepted Answer

Submit the same valid assertion response twice and confirm the server rejects the second attempt

Answer

Replay protection is validated by submitting a previously successful assertion a second time and verifying the server rejects it, typically by tracking used challenges or credential counters.

Question 5

During testing of the credential counter, a QA engineer observes the authenticator returns a counter value lower than the last stored value. What should a FIDO2-compliant server do?

Accepted Answer

Flag the credential as potentially cloned and refuse the authentication

Answer

A decreasing counter is a sign of a cloned authenticator; FIDO2 servers must treat this as a security error and refuse authentication.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Testing and Quality Assurance 3