FIDO Authentication Standards & Protocols 2 — Questions and Answers
Question 1: Which FIDO2 component is responsible for storing credentials and performing cryptographic operations?
- Relying Party Server
- Authenticator (Correct answer)
- Client (browser/platform)
- CTAP Transport Layer
Correct answer: Authenticator
The authenticator stores private keys and performs cryptographic signing operations during FIDO2 authentication.
Question 2: What does the 'origin' field in a WebAuthn ceremony protect against?
- Replay attacks
- Phishing attacks (Correct answer)
- Credential stuffing
- Brute-force attacks
Correct answer: Phishing attacks
The origin binding in WebAuthn ties credentials to a specific domain, making them unusable on phishing sites.
Question 3: In CTAP2, what is the purpose of the 'pinUvAuthProtocol' parameter?
- Defines the PIN length constraints
- Specifies the PIN/UV authentication protocol version to use (Correct answer)
- Sets the UV retry counter limit
- Configures biometric thresholds
Correct answer: Specifies the PIN/UV authentication protocol version to use
The 'pinUvAuthProtocol' parameter specifies which PIN/UV Auth Protocol version the platform and authenticator should use for PIN operations.
Question 4: Which assertion type does FIDO UAF use that is NOT present in WebAuthn/FIDO2?
- ECDSA signatures
- ASM-based transaction confirmation (Correct answer)
- Challenge-response flows
- Public key cryptography
Correct answer: ASM-based transaction confirmation
FIDO UAF introduced the Authenticator Specific Module (ASM) layer for transaction confirmation, which was not carried over into the WebAuthn/FIDO2 architecture.
Question 5: What is the maximum number of times a FIDO2 authenticator can attempt PIN entry before the PIN is blocked?
- 3
- 5
- 8 (Correct answer)
- 10
Correct answer: 8
CTAP2 allows up to 8 PIN retries before the PIN is permanently blocked and the authenticator must be reset.
Question 6: Which transport protocol introduced in CTAP2.1 allows authenticators to initiate communication?
- USB HID
- NFC
- Hybrid (caBLE) (Correct answer)
- Bluetooth LE
Correct answer: Hybrid (caBLE)
The Hybrid transport (also called Cloud-assisted Bluetooth Low Energy, or caBLE) enables cross-device authentication where the authenticator can be a phone that initiates the flow.
Question 7: In WebAuthn, what does 'rpId' represent in the context of credential scoping?
- The relying party's unique account identifier
- The effective domain to which a credential is bound (Correct answer)
- The registration policy identifier
- The random challenge prefix
Correct answer: The effective domain to which a credential is bound
The rpId is the effective domain (or a registrable domain suffix) that scopes the credential, preventing use across different origins.
FIDO Authentication Standards & Protocols 2
Which FIDO2 component is responsible for storing credentials and performing cryptographic operations?