FCP Public-Key Cryptography in FIDO

Question 1

What is the primary benefit of public-key cryptography in FIDO authentication?

Accepted Answer

It eliminates shared secrets

Answer

Public-key cryptography in FIDO eliminates the need for shared secrets, such as passwords, between the user and the service provider. Instead, the user's device proves identity by signing a challenge with its private key, which the service verifies using the publicly registered key. This design prevents credential theft from server breaches and phishing attacks, as no secret is ever transmitted or stored on the server.

Question 2

Which cryptographic method does FIDO use for authentication?

Accepted Answer

Asymmetric cryptography

Answer

FIDO authentication uses asymmetric cryptography, which is another term for public-key cryptography. This method involves a pair of keys: a private key kept secret on the user's device and a public key shared with the online service. This allows for secure challenge-response authentication where the private key never leaves the device, making it highly resistant to credential theft and impersonation.

Question 3

What role does the private key play in FIDO authentication?

Accepted Answer

It is stored securely on the device

Answer

In FIDO authentication, the private key is generated and stored securely on the user's authenticator device, such as a smartphone's secure enclave or a hardware security key. It never leaves the device and is used to cryptographically sign authentication challenges. This ensures that the user's identity is proven without the private key ever being exposed to the server or potential attackers.

Question 4

How does the public key in FIDO authentication improve security?

Accepted Answer

It verifies authentication requests

Answer

The public key in FIDO authentication is registered with the online service and is used to verify the cryptographic signature generated by the user's private key during an authentication request. This verification process confirms that the request originated from the legitimate user's device without requiring the server to ever know the private key. This separation of keys significantly enhances security by preventing credential compromise even if the server is breached.

Question 5

Which security measure protects private keys in FIDO authentication?

Accepted Answer

Secure hardware storage

Answer

FIDO private keys are protected by secure hardware storage, such as a Trusted Platform Module (TPM), Secure Enclave, or a dedicated hardware security key. This ensures that the private key is generated, stored, and used in an isolated environment, making it extremely difficult for malware or attackers to extract or compromise it. This hardware-backed security is a cornerstone of FIDO's robust protection.

(FCP) FIDO Certified Professional Practice Test

(FCP) FIDO Certified Professional Practice Test

FCP Public-Key Cryptography in FIDO