FIDO Technology & Digital Tools 2 — Questions and Answers
Question 1: Which transport protocol does a FIDO2 authenticator use when communicating over NFC?
- CTAP2 over ISO 14443 (Correct answer)
- CTAP1 over Bluetooth LE
- WebAuthn over HTTPS
- FIDO UAF over NFC-DEP
Correct answer: CTAP2 over ISO 14443
CTAP2 messages are carried over ISO 14443 (NFC) when an authenticator communicates with a platform via NFC.
Question 2: In the FIDO2 ecosystem, what is the role of the 'platform authenticator'?
- An authenticator built into the user's device OS or hardware (Correct answer)
- A USB security key plugged into the device
- A remote server that validates credentials
- A Bluetooth dongle paired with the device
Correct answer: An authenticator built into the user's device OS or hardware
A platform authenticator is integrated into the device itself (e.g., Windows Hello, Touch ID) rather than being a separate hardware token.
Question 3: What does the 'UV' flag in an authenticator assertion data structure indicate?
- User Verification was performed by the authenticator (Correct answer)
- User presence was confirmed via a button press
- The credential is unverified
- UV stands for Universal Version
Correct answer: User Verification was performed by the authenticator
The UV (User Verification) flag in authenticator data signals that the authenticator performed local user verification such as biometrics or PIN.
Question 4: Which algorithm identifier is used in FIDO2 for the EdDSA signature scheme over Curve25519?
- -8 (Correct answer)
- -7
- -257
- -36
Correct answer: -8
COSE algorithm identifier -8 (EdDSA) is used for the Ed25519 signature scheme in FIDO2 credentials.
Question 5: What is the purpose of the 'fmt' field in a FIDO2 attestation object?
- Identifies the attestation statement format being used (Correct answer)
- Specifies the cryptographic hash function
- Contains the raw public key bytes
- Indicates the FIDO protocol version
Correct answer: Identifies the attestation statement format being used
The 'fmt' field names the attestation format (e.g., 'packed', 'tpm', 'fido-u2f') so the relying party knows how to parse and verify the attestation statement.
Question 6: Which FIDO2 feature allows a credential to be backed up and restored across devices?
- Discoverable credentials with the BE flag set (Correct answer)
- Non-resident keys stored server-side
- CTAP1 backward compatibility mode
- Attestation certificate chaining
Correct answer: Discoverable credentials with the BE flag set
When the Backup Eligibility (BE) and Backup State (BS) flags are set in authenticatorData, the credential is a multi-device credential eligible for cloud backup.
Question 7: In CTAP2, what does a 'clientPin' sub-command allow the platform to do?
- Set, change, or verify the authenticator PIN on behalf of the user (Correct answer)
- Store the user's password hash on the token
- Generate a one-time PIN for server authentication
- Disable biometric fallback on the authenticator
Correct answer: Set, change, or verify the authenticator PIN on behalf of the user
The clientPin CTAP2 command family lets the platform manage PIN operations (set, change, getToken) to unlock the authenticator without exposing the PIN to the server.
FIDO Technology & Digital Tools 2
Which transport protocol does a FIDO2 authenticator use when communicating over NFC?