FIDO Case Analysis & Practical Application 4

Question 1

An enterprise deploys passkeys synced via iCloud Keychain for employees. The security team raises concerns about credential portability. Which risk is most relevant?

Accepted Answer

A compromised iCloud account could expose passkeys to an attacker who gains account access

Answer

Synced passkeys can be exported to competitor devices running Android

Answer

Synced passkeys bypass FIDO2 attestation entirely, making RP policy enforcement impossible

Answer

iCloud Keychain passkeys do not support user verification, weakening authentication strength

Question 2

A FIDO2 Relying Party wants to restrict authentication to only authenticators certified by the FIDO Alliance at Level 1 or higher. Which mechanism enables this policy enforcement?

Accepted Answer

Checking the authenticator's AAGUID against the FIDO Metadata Service (MDS) during attestation verification

Answer

Requiring all clients to present a valid FIDO Alliance membership certificate

Answer

Filtering authenticators by their supported transport types (USB, NFC, BLE)

Answer

Validating that the authenticator's firmware version meets a minimum build number

Question 3

A travel company's mobile app uses FIDO UAF biometric authentication. A user reports that after changing their fingerprint (adding a new finger) on their phone, the app no longer authenticates them. Why?

Accepted Answer

FIDO UAF keys are invalidated when the biometric template set changes on Android and iOS

Answer

The FIDO UAF server blocked the user after detecting anomalous authentication attempts

Answer

The user's FIDO UAF registration expired because biometric data changed

Answer

The app's certificate fingerprint changed after the OS detected new biometric data

Question 4

During a FIDO2 implementation review, an auditor finds that the RP stores the full authenticatorData blob returned during registration. Which field within this blob is most critical for future authentication verification?

Accepted Answer

The credentialPublicKey used to verify future assertion signatures

Answer

The aaguid field identifying the authenticator model

Answer

The rpIdHash confirming the correct RP was targeted during registration

Answer

The signCount baseline value for future counter comparison

Question 5

A company's FIDO2 deployment supports both roaming and platform authenticators. A user authenticates daily using Face ID (platform) but occasionally uses a hardware key (roaming). The RP notices the platform authenticator's signCount never increments. Is this a problem?

Accepted Answer

No, platform authenticators like Apple's are permitted to return a signCount of 0, indicating the counter is not implemented

Answer

Yes, all FIDO2 authenticators must increment signCount on every use

Answer

Yes, a static signCount means the credential is corrupted and should be revoked

Answer

No, signCount only applies to FIDO U2F credentials, not FIDO2

Question 6

An organization uses FIDO2 for VPN authentication. They want to ensure that only managed corporate devices can authenticate, not personal devices with passkeys. Which mechanism enforces this device restriction?

Accepted Answer

Requiring attestation from a specific AAGUID tied to the corporate-issued authenticator

Answer

Using 'userVerification: required' to ensure biometrics are used on all authentications

Answer

Filtering WebAuthn credentials by the transport type (USB only)

Answer

Requiring users to register their personal passkeys through the corporate IT portal

Question 7

A startup implements WebAuthn for the first time and sets 'attestationConveyancePreference' to 'none'. What is the security implication of this choice?

Accepted Answer

The RP cannot verify the make, model, or certification status of registered authenticators

Answer

Authentication ceremonies will fail because attestation is mandatory in WebAuthn

Answer

Users will be unable to register platform authenticators without attestation

Answer

The credential's public key will not be bound to the specific device used during registration