FIDO FIDO Deployment & Implementation Architecture 2

Question 1

What is the recommended approach for handling FIDO2 credential storage in a high-availability server cluster?

Accepted Answer

Use a shared database with proper indexing on credential IDs and user handles

Answer

A shared, persistent database with proper indexing ensures credentials are accessible across all cluster nodes and survive node restarts.

Question 2

When deploying FIDO2, what is the significance of the 'userVerification' parameter set to 'required'?

Accepted Answer

The authenticator must locally verify the user via PIN, biometric, or similar before signing

Answer

Setting userVerification to 'required' means the authenticator must perform local user verification (PIN, biometric) and set the UV flag in the authenticator data.

Question 3

What HTTP header is critical for WebAuthn to function correctly on a Relying Party website?

Accepted Answer

The site must be served over HTTPS with a valid TLS certificate

Answer

WebAuthn requires a secure context, meaning the Relying Party must serve its pages over HTTPS (or localhost for development).

Question 4

During FIDO2 implementation, what is an 'attestation statement' and why might an RP choose to verify it?

Accepted Answer

Cryptographic proof of the authenticator's model and manufacturer, used to enforce device policy

Answer

An attestation statement is cryptographic evidence about the authenticator's type and manufacturer, allowing RPs to enforce policies like requiring certified hardware keys.

Question 5

What is the purpose of the 'excludeCredentials' parameter sent by the RP during a WebAuthn registration request?

Accepted Answer

To prevent duplicate credential registrations on the same authenticator

Answer

The excludeCredentials list tells the authenticator to reject registration if the user already has a credential from that same device, preventing duplicates.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO FIDO Deployment & Implementation Architecture 2