FIDO Device Security & Cryptographic Operations 2 — Questions and Answers
Question 1: Which cryptographic primitive is used by FIDO2 authenticators to prove possession of a private key without revealing it?
- Symmetric encryption
- Digital signature (Correct answer)
- Key derivation function
- Message authentication code
Correct answer: Digital signature
FIDO2 authenticators use digital signatures (e.g., ECDSA or EdDSA) to prove private key possession during authentication assertions.
Question 2: What is the role of the 'aaguid' field stored in an authenticator's metadata?
- It uniquely identifies the individual device
- It identifies the authenticator model/type for attestation verification (Correct answer)
- It stores the user's credential ID
- It is the relying party identifier
Correct answer: It identifies the authenticator model/type for attestation verification
The AAGUID (Authenticator Attestation GUID) identifies the authenticator model so relying parties can look up its metadata and trust level.
Question 3: During FIDO2 registration, which value does the authenticator bind to the generated credential to prevent cross-origin misuse?
- User handle
- AAGUID
- rpId hash (Correct answer)
- Client data hash
Correct answer: rpId hash
The authenticator stores and later verifies the SHA-256 hash of the rpId so credentials cannot be used on a different origin.
Question 4: A FIDO authenticator implements a 'clone detection' counter. What happens if the counter received by the relying party is LESS THAN the stored value?
- Authentication succeeds with a warning log
- The assertion is rejected as a possible cloned authenticator (Correct answer)
- The counter is reset to the received value
- The user is prompted to re-register
Correct answer: The assertion is rejected as a possible cloned authenticator
A non-increasing signature counter signals a possible cloned device, and the relying party should reject the assertion.
Question 5: Which key agreement scheme is used in FIDO's PIN/UV Auth Protocol 2 (PINUV AP2) to establish a shared session key?
- RSA-OAEP
- ECDH with P-256 (Correct answer)
- DH with 2048-bit primes
- AES-KW with a static key
Correct answer: ECDH with P-256
PINUV AP2 uses ECDH over P-256 to derive a shared session key between the platform and the authenticator.
Question 6: What does 'credProtect' extension level 3 enforce on a FIDO2 authenticator?
- Credential ID can be returned without user verification
- User verification is required before any credential metadata is revealed (Correct answer)
- Credential works only on USB, not NFC
- Platform must store the credential, not the authenticator
Correct answer: User verification is required before any credential metadata is revealed
credProtect level 3 (userVerificationRequired) means the authenticator will not even reveal that a credential exists until user verification succeeds.
Question 7: In CTAP2, what is the maximum size (in bytes) of a credential ID that an authenticator MUST support by specification?
- 64 bytes
- 128 bytes (Correct answer)
- 1024 bytes
- No maximum is mandated
Correct answer: 128 bytes
CTAP2 requires authenticators to support credential IDs up to 1023 bytes, but platforms must handle up to 1023 bytes; the common practical ceiling cited in interoperability tests is 128 bytes for resident keys.
FIDO Device Security & Cryptographic Operations 2
Which cryptographic primitive is used by FIDO2 authenticators to prove possession of a private key without revealing it?