FIDO Case Analysis & Practical Application 4

Question 1

An enterprise deploys passkeys synced via iCloud Keychain for employees. The security team raises concerns about credential portability. Which risk is most relevant?

Accepted Answer

A compromised iCloud account could expose passkeys to an attacker who gains account access

Answer

If an attacker compromises the user's iCloud account, they may gain access to synced passkeys, making iCloud account security a critical dependency.

Question 2

A FIDO2 Relying Party wants to restrict authentication to only authenticators certified by the FIDO Alliance at Level 1 or higher. Which mechanism enables this policy enforcement?

Accepted Answer

Checking the authenticator's AAGUID against the FIDO Metadata Service (MDS) during attestation verification

Answer

The FIDO Metadata Service maps AAGUIDs to authenticator metadata including certification status, allowing RPs to enforce certification level policies during attestation.

Question 3

A travel company's mobile app uses FIDO UAF biometric authentication. A user reports that after changing their fingerprint (adding a new finger) on their phone, the app no longer authenticates them. Why?

Accepted Answer

FIDO UAF keys are invalidated when the biometric template set changes on Android and iOS

Answer

Both Android and iOS invalidate keys protected by biometrics when the biometric enrollment changes (fingerprint added/removed) to prevent unauthorized key use with new biometric data.

Question 4

During a FIDO2 implementation review, an auditor finds that the RP stores the full authenticatorData blob returned during registration. Which field within this blob is most critical for future authentication verification?

Accepted Answer

The credentialPublicKey used to verify future assertion signatures

Answer

The credentialPublicKey embedded in authenticatorData during registration is the public key used to verify cryptographic signatures in all subsequent authentication assertions.

Question 5

A company's FIDO2 deployment supports both roaming and platform authenticators. A user authenticates daily using Face ID (platform) but occasionally uses a hardware key (roaming). The RP notices the platform authenticator's signCount never increments. Is this a problem?

Accepted Answer

No, platform authenticators like Apple's are permitted to return a signCount of 0, indicating the counter is not implemented

Answer

The WebAuthn spec permits authenticators to always return a signCount of 0 (not implemented), and RPs should handle this case by not using counter-based clone detection for such authenticators.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Case Analysis & Practical Application 4