FIDO Authentication Standards & Protocols 3

Question 1

Which cryptographic algorithm is REQUIRED to be supported by all FIDO2 certified authenticators?

Accepted Answer

ES256 (ECDSA with P-256 and SHA-256)

Answer

ES256 (ECDSA using P-256 curve with SHA-256) is the mandatory algorithm all FIDO2 certified authenticators must support.

Question 2

What is the role of the 'aaguid' field in a FIDO2 attestation statement?

Accepted Answer

Identifies the make and model of the authenticator

Answer

The AAGUID (Authenticator Attestation GUID) is a 128-bit identifier that identifies the type (make and model) of the authenticator.

Question 3

During a WebAuthn authentication ceremony, what does the authenticator sign?

Accepted Answer

The authenticatorData concatenated with the hash of clientDataJSON

Answer

The authenticator signs the concatenation of authenticatorData and the SHA-256 hash of clientDataJSON to produce the assertion signature.

Question 4

What is 'discoverable credential' (formerly 'resident key') in FIDO2?

Accepted Answer

A credential stored on the authenticator that enables username-less authentication

Answer

A discoverable credential (resident key) is stored entirely on the authenticator, allowing the user to authenticate without providing a username first.

Question 5

Which FIDO specification defines the protocol between the client platform and an external authenticator?

Accepted Answer

CTAP (Client to Authenticator Protocol)

Answer

CTAP (Client to Authenticator Protocol), defined by the FIDO Alliance, specifies how client platforms communicate with external authenticators over USB, NFC, or BLE.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Authentication Standards & Protocols 3