FIDO User Verification & Biometric Integration 2

Question 1

In FIDO2, what does the 'uv' flag in the authenticator data (authData) indicate?

Accepted Answer

The authenticator performed user verification during the operation

Answer

The 'uv' bit in authenticator data flags that the authenticator successfully verified the user's identity (e.g., via biometric or PIN) during the ceremony.

Question 2

When a relying party sets userVerification to 'required' in WebAuthn, what happens if the authenticator cannot perform user verification?

Accepted Answer

The ceremony fails and returns an error

Answer

If userVerification is 'required' and the authenticator cannot satisfy it, the WebAuthn ceremony must fail rather than degrade to a weaker assertion.

Question 3

Which CTAP2 command parameter allows a client to request that an authenticator perform user verification?

Accepted Answer

options: {uv: true}

Answer

In CTAP2, the client passes options: {uv: true} in authenticatorMakeCredential or authenticatorGetAssertion to request user verification from the authenticator.

Question 4

A FIDO authenticator supports both biometric and PIN as user verification methods. If biometric fails after the maximum retry count, what typically occurs?

Accepted Answer

The authenticator blocks biometric and may fall back to PIN

Answer

After exhausting biometric retries, FIDO authenticators commonly block biometric use and allow PIN fallback to prevent brute-force biometric attacks.

Question 5

What is the primary privacy benefit of storing biometric templates on the authenticator device rather than on a server?

Accepted Answer

Biometric data never leaves the device, reducing exposure in server breaches

Answer

Keeping biometric templates local to the device ensures that a server-side breach cannot expose raw biometric data, which is a core FIDO privacy principle.

(FIDO) FIDO Certified Authenticator Practice Test

(FIDO) FIDO Certified Authenticator Practice Test

FIDO User Verification & Biometric Integration 2