FIDO Technology & Digital Tools 3 — Questions and Answers
Question 1: What is the WebAuthn 'allowCredentials' parameter used for during authentication?
- To restrict which credentials the authenticator may use (Correct answer)
- To list all registered users on the relying party
- To specify allowed cryptographic algorithms
- To define the timeout for the ceremony
Correct answer: To restrict which credentials the authenticator may use
allowCredentials is an optional list of credential descriptors the relying party accepts, guiding the authenticator to select the right key for the user.
Question 2: Which FIDO MDS (Metadata Service) data type is used to determine if an authenticator model has been revoked?
- statusReports containing REVOKED status (Correct answer)
- aaguid blacklist in the CTAP registry
- attestationRootCertificates with expired dates
- metadataStatement with trustLevel=0
Correct answer: statusReports containing REVOKED status
MDS statusReports entries with REVOKED status indicate that the authenticator model's certification has been withdrawn and should not be trusted.
Question 3: What cryptographic primitive does FIDO2 use to bind the authenticator's public key to its model identity during attestation?
- An attestation certificate signed by the manufacturer's CA (Correct answer)
- A symmetric HMAC keyed with the AAGUID
- A zero-knowledge proof of possession
- A server-issued token signed with ECDH
Correct answer: An attestation certificate signed by the manufacturer's CA
Attestation binds a credential's public key to the authenticator model via an attestation certificate signed by the manufacturer's certificate authority.
Question 4: What is 'hybrid transport' in the context of FIDO2 authenticators?
- A mechanism to use a phone as a roaming authenticator via QR code and BLE/cloud relay (Correct answer)
- A fallback that switches between USB and NFC automatically
- A dual-stack protocol supporting both CTAP1 and CTAP2
- A server-side proxy that bridges FIDO to SAML
Correct answer: A mechanism to use a phone as a roaming authenticator via QR code and BLE/cloud relay
Hybrid transport (also called caBLE) lets a smartphone act as a FIDO2 roaming authenticator by scanning a QR code and using a BLE/cloud relay tunnel.
Question 5: Which bit position in the authenticatorData 'flags' byte indicates that the authenticator supports attestation?
- Bit 6 (AT - Attested Credential Data included) (Correct answer)
- Bit 0 (UP - User Presence)
- Bit 2 (UV - User Verification)
- Bit 7 (ED - Extension Data included)
Correct answer: Bit 6 (AT - Attested Credential Data included)
Bit 6 of the flags byte is the AT flag, set when attested credential data is present in the authenticatorData structure.
Question 6: In FIDO UAF, what is the purpose of the 'Transaction Confirmation' feature?
- Displays a transaction string to the user who must authenticate to confirm it (Correct answer)
- Logs all authentication attempts to a secure audit trail
- Verifies that the transaction was processed by the server
- Encrypts transaction data with the user's private key
Correct answer: Displays a transaction string to the user who must authenticate to confirm it
UAF Transaction Confirmation presents a human-readable transaction string (e.g., payment amount) on the device display and requires user authentication to approve it.
Question 7: What is the maximum size of a CTAP2 credential ID according to the specification?
- 1023 bytes (Correct answer)
- 64 bytes
- 255 bytes
- 4096 bytes
Correct answer: 1023 bytes
The CTAP2 specification allows credential IDs up to 1023 bytes, though authenticators may support shorter lengths.
FIDO Technology & Digital Tools 3
What is the WebAuthn 'allowCredentials' parameter used for during authentication?