FIDO Device Security & Cryptographic Operations 3

Question 1

Which attestation format wraps the authenticator's attestation statement inside an X.509 certificate chain rooted at the FIDO Alliance MDS?

Accepted Answer

packed

Answer

The 'packed' attestation format supports full attestation using an X.509 certificate chain that can be verified against the FIDO MDS.

Question 2

What is the purpose of the 'largeBlobKey' extension in CTAP2.1?

Accepted Answer

To provide a per-credential symmetric key for storing large blobs on the authenticator

Answer

The largeBlobKey extension provides a symmetric key unique to each credential, used to encrypt and authenticate large blobs stored on the authenticator.

Question 3

An authenticator supports 'alwaysUv'. What does this flag indicate?

Accepted Answer

The authenticator always requires user verification, even for discoverable credentials

Answer

The 'alwaysUv' option means the authenticator enforces user verification for every assertion, regardless of the RP's UV preference.

Question 4

During TPM attestation, which structure contains the signed public key and the PCR digest that proves platform state?

Accepted Answer

TPM2B_ATTEST (certifyInfo)

Answer

TPM2B_ATTEST (the certifyInfo blob) contains the attested public key name and optionally PCR digests, all signed by the TPM's attestation key.

Question 5

What cryptographic algorithm does the FIDO Alliance recommend as the PRIMARY algorithm for new FIDO2 authenticators as of current specifications?

Accepted Answer

ES256 (ECDSA with P-256 and SHA-256)

Answer

ES256 (ECDSA over P-256 with SHA-256, COSE algorithm -7) is the mandatory-to-implement algorithm for FIDO2 authenticators.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO Device Security & Cryptographic Operations 3