FIDO FIDO Deployment & Implementation Architecture 2 — Questions and Answers
Question 1: What is the recommended approach for handling FIDO2 credential storage in a high-availability server cluster?
- Store credentials in memory on each node independently
- Use a shared database with proper indexing on credential IDs and user handles (Correct answer)
- Replicate credentials via the FIDO metadata service
- Store credentials only on the authenticator device
Correct answer: Use a shared database with proper indexing on credential IDs and user handles
A shared, persistent database with proper indexing ensures credentials are accessible across all cluster nodes and survive node restarts.
Question 2: When deploying FIDO2, what is the significance of the 'userVerification' parameter set to 'required'?
- The RP must verify the user's email before issuing a challenge
- The authenticator must locally verify the user via PIN, biometric, or similar before signing (Correct answer)
- The FIDO metadata service must confirm the authenticator is certified
- The browser must display a consent dialog before proceeding
Correct answer: The authenticator must locally verify the user via PIN, biometric, or similar before signing
Setting userVerification to 'required' means the authenticator must perform local user verification (PIN, biometric) and set the UV flag in the authenticator data.
Question 3: What HTTP header is critical for WebAuthn to function correctly on a Relying Party website?
- X-Frame-Options: DENY
- Content-Security-Policy: default-src 'self'
- The site must be served over HTTPS with a valid TLS certificate (Correct answer)
- Strict-Transport-Security: max-age=31536000
Correct answer: The site must be served over HTTPS with a valid TLS certificate
WebAuthn requires a secure context, meaning the Relying Party must serve its pages over HTTPS (or localhost for development).
Question 4: During FIDO2 implementation, what is an 'attestation statement' and why might an RP choose to verify it?
- A legal declaration by the user that they own the authenticator
- Cryptographic proof of the authenticator's model and manufacturer, used to enforce device policy (Correct answer)
- A signed token proving the user completed training on FIDO
- A hash of the user's credentials stored on the RP server
Correct answer: Cryptographic proof of the authenticator's model and manufacturer, used to enforce device policy
An attestation statement is cryptographic evidence about the authenticator's type and manufacturer, allowing RPs to enforce policies like requiring certified hardware keys.
Question 5: What is the purpose of the 'excludeCredentials' parameter sent by the RP during a WebAuthn registration request?
- To block specific users from registering new credentials
- To prevent duplicate credential registrations on the same authenticator (Correct answer)
- To list credentials that have been revoked by the FIDO Alliance
- To specify which cryptographic algorithms the RP does not support
Correct answer: To prevent duplicate credential registrations on the same authenticator
The excludeCredentials list tells the authenticator to reject registration if the user already has a credential from that same device, preventing duplicates.
Question 6: In a FIDO2 server deployment, what should an implementation do if the received 'challenge' in the authenticator response does not match the issued challenge?
- Log the mismatch and allow authentication with a warning
- Immediately reject the ceremony as a potential replay or tampering attack (Correct answer)
- Request a new challenge from the FIDO metadata service
- Fall back to password authentication
Correct answer: Immediately reject the ceremony as a potential replay or tampering attack
Challenge mismatch indicates a replay attack or data tampering, so the ceremony must be aborted and the response rejected outright.
FIDO FIDO Deployment & Implementation Architecture 2
What is the recommended approach for handling FIDO2 credential storage in a high-availability server cluster?