FIDO User Verification & Biometric Integration 3 — Questions and Answers
Question 1: FIDO specifications require that biometric templates be protected against extraction. Which attribute in authenticator metadata indicates the level of matcher protection?
- matcherProtection (Correct answer)
- keyProtection
- attachmentHint
- tcDisplayPNGCharacteristics
Correct answer: matcherProtection
The matcherProtection field describes whether the biometric matcher runs in software, TEE, or on-chip secure hardware, indicating how well templates are shielded from extraction.
Question 2: An authenticator stores biometric templates inside a Trusted Execution Environment (TEE). What is the main security advantage over storing templates in the normal OS?
- TEE isolates the template from the rich OS, preventing malware from reading it (Correct answer)
- TEE storage allows the template to sync across devices automatically
- TEE reduces matching latency by using dedicated hardware keys
- TEE templates are smaller and require less storage space
Correct answer: TEE isolates the template from the rich OS, preventing malware from reading it
A TEE provides hardware-enforced isolation so that malicious applications running in the normal OS cannot access or exfiltrate the biometric template.
Question 3: Under FIDO's approach to biometric privacy, which statement best describes how biometric data is treated across different relying parties?
- Biometric data stays on the device and is never sent to any relying party (Correct answer)
- Each relying party receives a hashed version of the biometric template
- Relying parties share biometric data through the FIDO server protocol
- Biometric data is encrypted with the relying party's public key before transmission
Correct answer: Biometric data stays on the device and is never sent to any relying party
FIDO's architecture ensures biometric templates remain on the authenticator device; relying parties only receive cryptographic signatures, never biometric data.
Question 4: A FIDO-certified authenticator must meet specific Biometric Requirements (FIDOBiometrics). Which False Acceptance Rate (FAR) threshold is mandated for Level 1 certification?
- Equal to or less than 1 in 10,000 (0.01%) (Correct answer)
- Equal to or less than 1 in 100 (1%)
- Equal to or less than 1 in 1,000,000 (0.0001%)
- Equal to or less than 1 in 1,000 (0.1%)
Correct answer: Equal to or less than 1 in 10,000 (0.01%)
FIDO Biometric Requirements for Level 1 specify a FAR threshold of no more than 1 in 10,000, balancing security with usability.
Question 5: What does the term 'template aging' refer to in biometric authentication systems?
- Gradual decline in matching accuracy as a user's biometric characteristics change over time (Correct answer)
- The expiration date assigned to a biometric credential by the relying party
- The process of encrypting old templates with newer keys
- Automatic deletion of biometric data after a fixed number of authentications
Correct answer: Gradual decline in matching accuracy as a user's biometric characteristics change over time
Template aging occurs when natural changes in a user's physiology (e.g., skin condition, facial changes) cause the stored template to diverge from live samples, increasing FRR over time.
Question 6: During FIDO authenticator certification testing for biometrics, what is evaluated by the 'Presentation Attack Detection' (PAD) requirement?
- The authenticator's ability to reject spoofing artifacts like photos or silicone fingers (Correct answer)
- The authenticator's performance under high-load concurrent authentication requests
- The accuracy of the biometric sensor under low-light or degraded conditions
- The authenticator's compliance with GDPR data minimization principles
Correct answer: The authenticator's ability to reject spoofing artifacts like photos or silicone fingers
PAD (also called liveness detection) testing verifies that the authenticator can distinguish real biometric samples from spoofing artifacts, protecting against presentation attacks.
Question 7: In FIDO2, the 'credProtect' extension can enforce user verification at the credential level. Which protection level requires UV for every assertion, including discovery?
- userVerificationRequired (level 3) (Correct answer)
- userVerificationOptionalWithCredentialIDList (level 2)
- userVerificationOptional (level 1)
- noCredentialRestriction (level 0)
Correct answer: userVerificationRequired (level 3)
credProtect level 3 (userVerificationRequired) mandates that the authenticator perform UV before returning any credential assertion, even during credential discovery.
FIDO User Verification & Biometric Integration 3
FIDO specifications require that biometric templates be protected against extraction.
Which attribute in authenticator metadata indicates the level of matcher protection?