FIDO FIDO Credential Lifecycle & Key Management 2

Question 1

What is the purpose of credential revocation management on the Relying Party side in a FIDO2 deployment?

Accepted Answer

To remove or disable stored public key credentials so they can no longer authenticate a user

Answer

RPs manage revocation by deleting or flagging stored public key credentials, preventing their use in future authentication ceremonies.

Question 2

In the context of FIDO key lifecycle, what is 'attestation key' versus 'credential key'?

Accepted Answer

The attestation key is a factory-burned device key used to prove authenticator provenance; the credential key is the per-RP key generated at registration

Answer

The attestation key (or batch key) is provisioned by the manufacturer to identify the authenticator model, while credential keys are unique per-registration key pairs generated by the authenticator.

Question 3

Why should Relying Parties store the 'aaguid' (Authenticator Attestation GUID) alongside each credential?

Accepted Answer

It identifies the authenticator model, enabling future policy enforcement if a vulnerability is discovered in that model

Answer

Storing the aaguid lets the RP retroactively apply policies if a specific authenticator model is later found to be vulnerable, enabling targeted credential invalidation.

Question 4

What is the recommended practice when a user wants to rotate their FIDO2 credential (e.g., after a security incident)?

Accepted Answer

Have the user re-register a new credential after authenticating via an alternate verified method, then delete the old one

Answer

Credential rotation requires re-registration: authenticate the user through an alternate path, register a new credential, then revoke the old one from the RP's credential store.

Question 5

What does the 'backup eligibility' (BE) flag in FIDO2 authenticator data indicate?

Accepted Answer

The credential is eligible to be backed up and synced to another device or cloud keychain

Answer

The BE flag indicates the authenticator supports syncing this credential to other devices, letting RPs enforce policies around synced versus device-bound credentials.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO FIDO Credential Lifecycle & Key Management 2