FIDO Authentication Standards & Protocols 3 — Questions and Answers
Question 1: Which cryptographic algorithm is REQUIRED to be supported by all FIDO2 certified authenticators?
- RSA-2048 with PKCS#1 v1.5
- ES256 (ECDSA with P-256 and SHA-256) (Correct answer)
- EdDSA with Ed25519
- RS256 (RSA with SHA-256)
Correct answer: ES256 (ECDSA with P-256 and SHA-256)
ES256 (ECDSA using P-256 curve with SHA-256) is the mandatory algorithm all FIDO2 certified authenticators must support.
Question 2: What is the role of the 'aaguid' field in a FIDO2 attestation statement?
- Identifies the user's account globally
- Identifies the make and model of the authenticator (Correct answer)
- Stores the attestation certificate serial number
- Specifies the allowed AAGUID list for the RP
Correct answer: Identifies the make and model of the authenticator
The AAGUID (Authenticator Attestation GUID) is a 128-bit identifier that identifies the type (make and model) of the authenticator.
Question 3: During a WebAuthn authentication ceremony, what does the authenticator sign?
- The full JSON clientDataJSON object
- The authenticatorData concatenated with the hash of clientDataJSON (Correct answer)
- The challenge bytes alone
- The rpId and userHandle combined
Correct answer: The authenticatorData concatenated with the hash of clientDataJSON
The authenticator signs the concatenation of authenticatorData and the SHA-256 hash of clientDataJSON to produce the assertion signature.
Question 4: What is 'discoverable credential' (formerly 'resident key') in FIDO2?
- A credential whose private key is stored server-side
- A credential stored on the authenticator that enables username-less authentication (Correct answer)
- A credential that can be discovered by any relying party
- A credential synchronized across multiple authenticators automatically
Correct answer: A credential stored on the authenticator that enables username-less authentication
A discoverable credential (resident key) is stored entirely on the authenticator, allowing the user to authenticate without providing a username first.
Question 5: Which FIDO specification defines the protocol between the client platform and an external authenticator?
- WebAuthn (W3C)
- CTAP (Client to Authenticator Protocol) (Correct answer)
- UAF (Universal Authentication Framework)
- SAML 2.0 Binding
Correct answer: CTAP (Client to Authenticator Protocol)
CTAP (Client to Authenticator Protocol), defined by the FIDO Alliance, specifies how client platforms communicate with external authenticators over USB, NFC, or BLE.
Question 6: What field in authenticatorData contains the relying party identifier hash?
- rpIdHash (Correct answer)
- flagsByte
- signCount
- attestedCredentialData
Correct answer: rpIdHash
The first 32 bytes of authenticatorData contain the rpIdHash, the SHA-256 hash of the relying party ID.
Question 7: In FIDO2, what does the 'UP' flag in authenticatorData indicate?
- User Presence was verified during the ceremony (Correct answer)
- User Privacy mode is enabled
- UV Protection is active
- Unique Passkey has been issued
Correct answer: User Presence was verified during the ceremony
The UP (User Presence) flag indicates that the authenticator confirmed user presence, typically via a button press or touch.
FIDO Authentication Standards & Protocols 3
Which cryptographic algorithm is REQUIRED to be supported by all FIDO2 certified authenticators?