FIDO FIDO Deployment & Implementation Architecture

Question 1

What is the primary role of a Relying Party (RP) in a FIDO2 deployment?

Accepted Answer

A web service or application that accepts FIDO-based authentication credentials

Answer

A Relying Party is the web service or application that verifies FIDO credentials during authentication and registration ceremonies.

Question 2

Which component in a FIDO2 architecture is responsible for storing the credential public key after registration?

Accepted Answer

The Relying Party server

Answer

The Relying Party server stores the user's credential public key and credential ID after a successful registration ceremony.

Question 3

During a FIDO2 WebAuthn registration ceremony, what does the Relying Party send to the client to initiate the process?

Accepted Answer

A challenge nonce and RP identity information

Answer

The Relying Party sends a random challenge nonce along with RP identity information (rpId, rpName) to start the registration ceremony.

Question 4

What is the purpose of the 'origin' validation step performed by the Relying Party during a WebAuthn ceremony?

Accepted Answer

To verify the request originated from the legitimate RP domain, preventing phishing

Answer

Origin validation ensures the WebAuthn ceremony was initiated from the expected RP domain, making FIDO inherently phishing-resistant.

Question 5

In a FIDO2 server implementation, what does the 'rpId' field represent?

Accepted Answer

The effective domain of the Relying Party used to scope credentials

Answer

The rpId is the effective domain (e.g., 'example.com') that scopes credentials, ensuring they can only be used on that domain or its subdomains.

(FIDO) FIDO Certified Authenticator Practice Test