FIDO Authentication Standards & Protocols 1 — Questions and Answers

Question 1: What does FIDO stand for?

Fast International Device Operation
Fast IDentity Online (Correct answer)
Federated Identity & Data Operations
Framework for Identification & Development Operations

Correct answer: Fast IDentity Online

FIDO is an acronym for "Fast IDentity Online." It represents a set of open standards designed to reduce the reliance on passwords for authentication, aiming to make online authentication simpler and more secure. The FIDO Alliance develops these specifications to promote a passwordless future.

Question 2: Which protocol is commonly associated with FIDO2?

OAuth2
SAML
WebAuthn (Correct answer)
OpenID Connect

Correct answer: WebAuthn

WebAuthn (Web Authentication) is the core protocol associated with FIDO2, which is the latest set of FIDO specifications. It is a web standard published by the W3C and FIDO Alliance that allows users to authenticate to web services using strong, phishing-resistant credentials via authenticators like biometric sensors or security keys. WebAuthn enables passwordless and multi-factor authentication directly within web browsers.

Question 3: What is a key benefit of using public key cryptography in FIDO?

Requires fewer credentials
Uses symmetric keys
Enhances security with asymmetric keys (Correct answer)
Allows shared secrets

Correct answer: Enhances security with asymmetric keys

FIDO leverages public key cryptography, which uses a pair of mathematically linked keys: a public key and a private key. The private key remains on the user's device, while the public key is registered with the online service. This asymmetric key system enhances security because the private key is never transmitted, making it resistant to phishing and server breaches, unlike shared secrets or symmetric keys.

Question 4: Which factor is NOT part of multi-factor authentication (MFA)?

A fingerprint
A password
A smartphone
An IP address (Correct answer)

Correct answer: An IP address

Multi-factor authentication (MFA) requires a user to provide two or more distinct verification factors from different categories to gain access. These categories typically include something you know, something you have, and something you are. An IP address is a network identifier and does not fall into any of these distinct authentication factor categories; it's typically used for location-based security checks, not as an authentication factor itself.

Question 5: What is U2F in FIDO standards?

Universal Transfer Format
Unified Token Field
Universal 2nd Factor (Correct answer)
User-to-File protocol

Correct answer: Universal 2nd Factor

U2F stands for "Universal 2nd Factor." It is an open authentication standard that strengthens and simplifies two-factor authentication using specialized USB, NFC, or Bluetooth security devices. U2F was one of the early FIDO specifications, designed to provide a strong, phishing-resistant second factor for login.

Question 6: Which device can act as a FIDO authenticator?

Web server
Smartphone biometric sensor (Correct answer)
Cloud storage
VPN router

Correct answer: Smartphone biometric sensor

A FIDO authenticator is a device that generates and stores cryptographic keys used for authentication. Smartphone biometric sensors (like fingerprint readers or facial recognition) can act as platform authenticators, allowing users to authenticate directly from their device using biometrics, without needing a separate physical security key. This makes the smartphone itself a FIDO-compliant authenticator.

Question 7: What is the role of the relying party in FIDO?

Issues authentication challenges
Acts as a device manager
Verifies authentication results (Correct answer)
Generates hardware tokens

Correct answer: Verifies authentication results

In the FIDO authentication flow, the relying party is the online service or application that the user is trying to access (e.g., a website, an enterprise application). Its role is to receive the authentication response from the user's authenticator and verify its cryptographic signature using the public key it previously registered for that user. This verification confirms the user's identity and grants access.

Question 8: Which standard allows use of platform authenticators?

U2F
WebAuthn (Correct answer)
SAML
LDAP

Correct answer: WebAuthn

WebAuthn (Web Authentication) is the FIDO standard that specifically enables the use of platform authenticators, such as built-in biometric sensors (fingerprint, facial recognition) or Trusted Platform Modules (TPMs) on devices like smartphones, laptops, and tablets. It allows these native device capabilities to serve as strong, phishing-resistant authenticators for web services.

Question 9: Why is FIDO considered phishing-resistant?

It uses long passwords
It relies on VPN access
Credentials are not reusable or phishable (Correct answer)
It prevents biometric use

Correct answer: Credentials are not reusable or phishable

FIDO is considered phishing-resistant because it uses public key cryptography where the private key never leaves the user's device and is bound to the origin of the website. This means that even if a user is tricked into visiting a fake website, their authenticator will not release the correct credentials, as the origin won't match. The unique cryptographic keys generated for each service cannot be intercepted and reused by attackers.

FIDO Authentication Standards & Protocols 1

What does FIDO stand for?