FIDO Case Analysis & Practical Application 3 — Questions and Answers
Question 1: A SaaS company wants to implement FIDO2 but their users span dozens of organizations with different IT policies. Which FIDO architecture component best addresses federated identity across these organizations?
- Deploying separate Relying Party servers for each organization
- Using a FIDO metadata service to normalize authenticator trust across organizations
- Implementing a shared IdP that federates FIDO assertions to each tenant RP (Correct answer)
- Requiring all organizations to use the same hardware security key model
Correct answer: Implementing a shared IdP that federates FIDO assertions to each tenant RP
A federated Identity Provider that supports FIDO2 can authenticate users and issue tokens accepted by each tenant's Relying Party without requiring per-RP credential registration.
Question 2: An RP's WebAuthn implementation sets the 'userVerification' parameter to 'required' but many users' authenticators only support user presence (touch). What is the outcome?
- Authenticators without UV capability silently skip verification and succeed
- The ceremony fails for those authenticators because UV is required but unavailable (Correct answer)
- The RP automatically downgrades the requirement to 'preferred' at runtime
- Users are prompted to set a PIN before the authenticator can be used
Correct answer: The ceremony fails for those authenticators because UV is required but unavailable
When userVerification is 'required' and the authenticator cannot perform UV, the WebAuthn ceremony returns an error and authentication fails.
Question 3: During a penetration test, a tester attempts to replay a captured WebAuthn assertion to a different origin than the original RP. What prevents this attack?
- The signature counter incrementing on every use
- The clientDataJSON binding the assertion to the specific origin via rpId (Correct answer)
- The attestation certificate tying the credential to the original RP
- The challenge nonce expiring after a fixed timeout period
Correct answer: The clientDataJSON binding the assertion to the specific origin via rpId
The authenticator signs clientDataJSON which includes the origin, so an assertion captured for one origin cannot be replayed to a different RP's origin.
Question 4: A retail website implements FIDO2 passkeys but wants to support account recovery when a user loses all their devices. Which approach is FIDO-compliant and maintains security?
- Store a backup copy of the private key on the server during registration
- Require users to register at least two authenticators (e.g., hardware key + platform authenticator) (Correct answer)
- Fall back to knowledge-based security questions for account recovery
- Generate a one-time recovery code at registration and store it hashed on the server
Correct answer: Require users to register at least two authenticators (e.g., hardware key + platform authenticator)
Registering multiple authenticators per account is the FIDO-recommended approach for account recovery, ensuring the user always has a backup credential.
Question 5: A company uses FIDO UAF for its mobile banking app. After an OS update, some Android users can no longer authenticate. What is the most likely cause?
- The FIDO UAF client was unregistered because the app's signing certificate changed after the OS update
- The server-side FIDO UAF facet list was not updated to reflect the new OS version (Correct answer)
- The biometric authenticator's AAGUID changed after the OS update
- The app's FIDO UAF registration expired due to inactivity
Correct answer: The server-side FIDO UAF facet list was not updated to reflect the new OS version
FIDO UAF uses facets (including the app's package name and certificate hash) for binding; if the facet list on the server doesn't include the updated app identity, authentication fails.
Question 6: An authenticator vendor claims their device achieves FIDO2 Level 2 certification. What assurance does this provide to a Relying Party?
- The authenticator's firmware has been independently audited and confirmed tamper-resistant (Correct answer)
- The authenticator passed FIDO Alliance interoperability testing only
- The authenticator meets basic WebAuthn API compliance but no hardware security requirements
- The authenticator's private keys are generated in a certified hardware security module
Correct answer: The authenticator's firmware has been independently audited and confirmed tamper-resistant
FIDO Authenticator Certification Level 2 requires an independent security review confirming the authenticator's resistance to software attacks and basic physical attack resistance.
Question 7: A developer is building a WebAuthn Relying Party and must choose between storing credentials indexed by user handle vs. username. Which approach aligns with FIDO2 privacy best practices?
- Index by username to simplify user management and debugging
- Index by user handle (opaque byte array) to prevent authenticators from leaking usernames (Correct answer)
- Use email address as both username and user handle for consistency
- Store credentials by AAGUID to group credentials by authenticator type
Correct answer: Index by user handle (opaque byte array) to prevent authenticators from leaking usernames
FIDO2 specifies that user handles should be opaque identifiers (not usernames or emails) so that authenticators storing resident credentials do not expose PII.
FIDO Case Analysis & Practical Application 3
A SaaS company wants to implement FIDO2 but their users span dozens of organizations with different IT policies.
Which FIDO architecture component best addresses federated identity across these organizations?