FIDO Device Security & Cryptographic Operations 2

Question 1

Which cryptographic primitive is used by FIDO2 authenticators to prove possession of a private key without revealing it?

Accepted Answer

Digital signature

Answer

FIDO2 authenticators use digital signatures (e.g., ECDSA or EdDSA) to prove private key possession during authentication assertions.

Question 2

What is the role of the 'aaguid' field stored in an authenticator's metadata?

Accepted Answer

It identifies the authenticator model/type for attestation verification

Answer

The AAGUID (Authenticator Attestation GUID) identifies the authenticator model so relying parties can look up its metadata and trust level.

Question 3

During FIDO2 registration, which value does the authenticator bind to the generated credential to prevent cross-origin misuse?

Accepted Answer

rpId hash

Answer

The authenticator stores and later verifies the SHA-256 hash of the rpId so credentials cannot be used on a different origin.

Question 4

A FIDO authenticator implements a 'clone detection' counter. What happens if the counter received by the relying party is LESS THAN the stored value?

Accepted Answer

The assertion is rejected as a possible cloned authenticator

Answer

A non-increasing signature counter signals a possible cloned device, and the relying party should reject the assertion.

Question 5

Which key agreement scheme is used in FIDO's PIN/UV Auth Protocol 2 (PINUV AP2) to establish a shared session key?

Accepted Answer

ECDH with P-256

Answer

PINUV AP2 uses ECDH over P-256 to derive a shared session key between the platform and the authenticator.

(FIDO) FIDO Certified Authenticator Practice Test