FIDO Risk Assessment & Mitigation 3 — Questions and Answers
Question 1: A security architect rates an authenticator that stores keys in a Trusted Execution Environment (TEE) versus one using software-only storage. What risk difference is most significant?
- TEE authenticators are slower and increase latency risk
- Software-only key storage is more vulnerable to OS-level malware extracting the private key (Correct answer)
- TEE authenticators cannot support user verification
- Software authenticators provide stronger attestation certificates
Correct answer: Software-only key storage is more vulnerable to OS-level malware extracting the private key
Software-stored keys can be extracted by privileged malware, while TEE hardware isolation prevents key extraction even from a compromised OS.
Question 2: Which scenario represents a supply chain risk specific to FIDO hardware authenticators?
- A user registers the same authenticator at two different relying parties
- An attacker distributes counterfeit authenticators with backdoored firmware pre-installed (Correct answer)
- A relying party fails to validate the user's email during registration
- An authenticator generates a new key pair on every authentication
Correct answer: An attacker distributes counterfeit authenticators with backdoored firmware pre-installed
Counterfeit or tampered authenticators could undermine FIDO's security guarantees before they reach end users.
Question 3: In FIDO threat modeling, what is the primary purpose of the 'clientDataHash' included in the authenticator assertion?
- To encrypt the user's PIN before transmission
- To cryptographically bind the assertion to the specific client and origin, preventing replay (Correct answer)
- To identify the relying party's server geographic location
- To compress the authentication response for faster transmission
Correct answer: To cryptographically bind the assertion to the specific client and origin, preventing replay
The clientDataHash ties the signature to the challenge and origin, ensuring assertions cannot be replayed in a different context.
Question 4: An organization assesses risk of a FIDO authenticator being used after an employee is terminated. Which mitigation is most appropriate?
- Revoking the attestation certificate globally
- Deleting the user's credential record at the relying party to invalidate the authenticator (Correct answer)
- Requiring the employee to return the hardware authenticator only
- Disabling user presence checks for that account
Correct answer: Deleting the user's credential record at the relying party to invalidate the authenticator
Removing the server-side credential entry means the authenticator's public key is no longer trusted, blocking future authentications even if the device is retained.
Question 5: Which risk does biometric spoofing (presentation attack) target in a FIDO authenticator, and what mitigates it?
- It targets the network channel; mitigated by TLS pinning
- It targets the user verification step; mitigated by Presentation Attack Detection (PAD) in the sensor (Correct answer)
- It targets the attestation certificate; mitigated by hardware root of trust
- It targets the relying party's challenge; mitigated by nonce expiration
Correct answer: It targets the user verification step; mitigated by Presentation Attack Detection (PAD) in the sensor
PAD (liveness detection) in the biometric sensor rejects fake fingerprints or face replicas, protecting the user verification step.
Question 6: A FIDO deployment allows authenticators without PIN/biometric (user presence only). Which authentication assurance level does this correspond to in NIST SP 800-63B?
- AAL3, because hardware is used
- AAL2, because the device is a second factor
- AAL1, because single-factor possession without identity verification (Correct answer)
- AAL3, because FIDO is always the highest assurance
Correct answer: AAL1, because single-factor possession without identity verification
Without user verification, FIDO provides only single-factor (possession) authentication, aligning with AAL1 in NIST terminology.
Question 7: What risk does 'credential stuffing' pose in a FIDO-only authentication environment compared to a password-based environment?
- Credential stuffing is more dangerous because FIDO credentials are reusable
- Credential stuffing is eliminated because FIDO credentials are device-bound and not shared secrets (Correct answer)
- Credential stuffing risk is the same because attackers target the registration flow
- Credential stuffing is mitigated only if attestation is validated
Correct answer: Credential stuffing is eliminated because FIDO credentials are device-bound and not shared secrets
FIDO credentials are asymmetric key pairs never transmitted as secrets, so lists of stolen credentials are useless for authentication.
FIDO Risk Assessment & Mitigation 3
A security architect rates an authenticator that stores keys in a Trusted Execution Environment (TEE) versus one using software-only storage.
What risk difference is most significant?