FIDO FIDO Credential Lifecycle & Key Management

Question 1

In FIDO2, what type of cryptographic key pair is generated during the registration ceremony?

Accepted Answer

An asymmetric key pair where the private key never leaves the authenticator

Answer

FIDO2 registration generates an asymmetric key pair; the private key is generated and stored securely inside the authenticator and never exported.

Question 2

What is a 'resident credential' (discoverable credential) in FIDO2, and how does it differ from a non-resident credential?

Accepted Answer

A credential stored directly on the authenticator, enabling usernameless login without a credential ID hint

Answer

Resident credentials are stored on the authenticator itself, allowing the user to authenticate without providing a username or credential ID hint (passwordless flow).

Question 3

How does a FIDO2 authenticator protect the private key from extraction in a software-based (platform) authenticator?

Accepted Answer

By storing it in a hardware-backed secure enclave such as TPM or Secure Enclave

Answer

Platform authenticators use hardware-backed secure storage (TPM on Windows, Secure Enclave on Apple devices) to protect private keys from OS-level extraction.

Question 4

What happens to a FIDO2 private key when a user deletes a passkey from their device?

Accepted Answer

It is permanently destroyed on the authenticator and the corresponding public key on the RP becomes unusable

Answer

Deleting a passkey destroys the private key on the authenticator; the RP's stored public key is now an orphaned, non-functional credential.

Question 5

Which FIDO2 concept describes credentials that are synchronized across a user's devices via a cloud account (e.g., iCloud Keychain, Google Password Manager)?

Accepted Answer

Synced passkeys

Answer

Synced passkeys are discoverable credentials backed up and synchronized across devices through a platform's cloud keychain, enabling multi-device passkey access.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO FIDO Credential Lifecycle & Key Management