FIDO User Verification & Biometric Integration 2 — Questions and Answers
Question 1: In FIDO2, what does the 'uv' flag in the authenticator data (authData) indicate?
- The authenticator performed user verification during the operation (Correct answer)
- The authenticator is a USB-based device
- The user has registered a backup credential
- The relying party requested silent authentication
Correct answer: The authenticator performed user verification during the operation
The 'uv' bit in authenticator data flags that the authenticator successfully verified the user's identity (e.g., via biometric or PIN) during the ceremony.
Question 2: When a relying party sets userVerification to 'required' in WebAuthn, what happens if the authenticator cannot perform user verification?
- The ceremony fails and returns an error (Correct answer)
- The authenticator falls back to user presence only
- The server silently accepts the response anyway
- The browser prompts for a software PIN instead
Correct answer: The ceremony fails and returns an error
If userVerification is 'required' and the authenticator cannot satisfy it, the WebAuthn ceremony must fail rather than degrade to a weaker assertion.
Question 3: Which CTAP2 command parameter allows a client to request that an authenticator perform user verification?
- options: {uv: true} (Correct answer)
- extensions: {uvRequired: true}
- pinAuth with empty value
- flags: UV_REQUIRED
Correct answer: options: {uv: true}
In CTAP2, the client passes options: {uv: true} in authenticatorMakeCredential or authenticatorGetAssertion to request user verification from the authenticator.
Question 4: A FIDO authenticator supports both biometric and PIN as user verification methods. If biometric fails after the maximum retry count, what typically occurs?
- The authenticator blocks biometric and may fall back to PIN (Correct answer)
- The authenticator permanently locks the credential
- The authenticator resets the biometric template
- The relying party is notified to issue a new challenge
Correct answer: The authenticator blocks biometric and may fall back to PIN
After exhausting biometric retries, FIDO authenticators commonly block biometric use and allow PIN fallback to prevent brute-force biometric attacks.
Question 5: What is the primary privacy benefit of storing biometric templates on the authenticator device rather than on a server?
- Biometric data never leaves the device, reducing exposure in server breaches (Correct answer)
- Server-side storage is slower so device storage improves performance
- On-device templates can be shared across multiple relying parties
- Device storage eliminates the need for user consent
Correct answer: Biometric data never leaves the device, reducing exposure in server breaches
Keeping biometric templates local to the device ensures that a server-side breach cannot expose raw biometric data, which is a core FIDO privacy principle.
Question 6: In the context of FIDO2, what distinguishes 'user presence' (UP) from 'user verification' (UV)?
- UP confirms a human touched the device; UV confirms the identity of that specific user (Correct answer)
- UP requires a biometric; UV only requires a button press
- UP is enforced by the relying party; UV is enforced by the browser
- UP and UV are synonymous in FIDO2
Correct answer: UP confirms a human touched the device; UV confirms the identity of that specific user
User presence (UP) merely proves a human interacted with the authenticator, while user verification (UV) additionally confirms that the interacting person is the legitimate enrolled user.
Question 7: Which metadata statement field in the FIDO Metadata Service (MDS) describes the user verification methods an authenticator supports?
- userVerificationDetails (Correct answer)
- attestationTypes
- keyProtection
- matcherProtection
Correct answer: userVerificationDetails
The userVerificationDetails field in MDS metadata lists all UV methods (biometric, PIN, passcode, etc.) supported by the authenticator.
FIDO User Verification & Biometric Integration 2
In FIDO2, what does the 'uv' flag in the authenticator data (authData) indicate?