Lesson test: Passkeys and WebAuthn

Sign in

Libre University uses your GitHub account. Signing in is only needed to sit a final test, so the score is kept on your profile.

Passkeys and WebAuthn

1.[3p]
What does the authenticator actually sign during an authentication ceremony?

The raw authenticatorData bytes followed by SHA-256 of the clientDataJSON

Correct

The challenge on its own

The answer is: The raw authenticatorData bytes followed by SHA-256 of the clientDataJSON

SHA-256 of the authenticatorData followed by the clientDataJSON

The answer is: The raw authenticatorData bytes followed by SHA-256 of the clientDataJSON

The clientDataJSON on its own

The answer is: The raw authenticatorData bytes followed by SHA-256 of the clientDataJSON

2.[3p]
`authenticatorData` is rpIdHash, then flags, then the signature counter. How many bytes is it when no attested credential data or extensions follow?

CorrectNot quite: 37

3.[3p]
A flags byte of `0x41` arrives at registration. Which bits are set?

UP and AT, so the user was present but not verified

Correct

UP and UV, so the user was present and verified

The answer is: UP and AT, so the user was present but not verified

UV and AT, with no user presence test

The answer is: UP and AT, so the user was present but not verified

UP, UV and BE, a verified synced passkey

The answer is: UP and AT, so the user was present but not verified

4.[3p]
Why can a phishing page on `examp1e.com` not obtain a usable signature for `example.com`?

Select all that apply

The browser only offers credentials whose relying party identifier matches the current domain

Correct

The browser writes the real origin into clientDataJSON and the authenticator signs over it

Correct

The user has no secret to type, so there is nothing to hand over

Correct

The challenge expires before the page can relay it

The answer is: The browser only offers credentials whose relying party identifier matches the current domain, The browser writes the real origin into clientDataJSON and the authenticator signs over it, The user has no secret to type, so there is nothing to hand over

5.[2p]
Comparing `clientData.origin` with `endsWith("example.com")` is an acceptable origin check.

True

The answer is: False

False

Correct

6.[3p]
Match each part of the verification checklist to what it establishes.

Exact origin equality
rpIdHash against SHA-256 of your domain
Challenge equals the stored one
UV flag set

a biometric or PIN was checked, so there are two factors
the authenticator signed for your relying party
this is not a replayed signature
the ceremony ran on your site and not a lookalike

Show the answer

Exact origin equality: the ceremony ran on your site and not a lookalike rpIdHash against SHA-256 of your domain: the authenticator signed for your relying party Challenge equals the stored one: this is not a replayed signature UV flag set: a biometric or PIN was checked, so there are two factors

7.[3p]
Why does `crypto.subtle.verify` reject a WebAuthn ES256 signature that was passed through unchanged?

WebAuthn returns the signature DER encoded and Web Crypto expects the raw 64-byte r and s

Correct

Web Crypto only verifies RS256

The answer is: WebAuthn returns the signature DER encoded and Web Crypto expects the raw 64-byte r and s

The signature covers the challenge rather than the authenticatorData

The answer is: WebAuthn returns the signature DER encoded and Web Crypto expects the raw 64-byte r and s

The public key must be re-imported for each verification

The answer is: WebAuthn returns the signature DER encoded and Web Crypto expects the raw 64-byte r and s

8.[3p]
What does a discoverable credential make possible that a non-discoverable one does not?

Signing in with no username, since the authenticator returns the user handle itself

Correct

Signing in without a biometric or PIN

The answer is: Signing in with no username, since the authenticator returns the user handle itself

Using the same credential across several relying parties

The answer is: Signing in with no username, since the authenticator returns the user handle itself

Verifying the signature without storing a public key

The answer is: Signing in with no username, since the authenticator returns the user handle itself

9.[3p]
Why has the signature counter largely stopped detecting cloned credentials?

Synced passkeys report zero every time, because one counter cannot be kept across several devices

Correct

Browsers strip the counter before the server sees it

The answer is: Synced passkeys report zero every time, because one counter cannot be kept across several devices

The counter is only present when attestation is requested

The answer is: Synced passkeys report zero every time, because one counter cannot be kept across several devices

It overflows after 65,536 assertions

The answer is: Synced passkeys report zero every time, because one counter cannot be kept across several devices

1.[3p] What does the authenticator actually sign during an authentication ceremony?

2.[3p] authenticatorData is rpIdHash, then flags, then the signature counter. How many bytes is it when no attested credential data or extensions follow?

3.[3p] A flags byte of 0x41 arrives at registration. Which bits are set?

4.[3p] Why can a phishing page on examp1e.com not obtain a usable signature for example.com?

5.[2p] Comparing clientData.origin with endsWith("example.com") is an acceptable origin check.

6.[3p] Match each part of the verification checklist to what it establishes.

7.[3p] Why does crypto.subtle.verify reject a WebAuthn ES256 signature that was passed through unchanged?

8.[3p] What does a discoverable credential make possible that a non-discoverable one does not?

9.[3p] Why has the signature counter largely stopped detecting cloned credentials?

1.[3p]
What does the authenticator actually sign during an authentication ceremony?

2.[3p]
`authenticatorData` is rpIdHash, then flags, then the signature counter. How many bytes is it when no attested credential data or extensions follow?

3.[3p]
A flags byte of `0x41` arrives at registration. Which bits are set?

4.[3p]
Why can a phishing page on `examp1e.com` not obtain a usable signature for `example.com`?

5.[2p]
Comparing `clientData.origin` with `endsWith("example.com")` is an acceptable origin check.

6.[3p]
Match each part of the verification checklist to what it establishes.

7.[3p]
Why does `crypto.subtle.verify` reject a WebAuthn ES256 signature that was passed through unchanged?

8.[3p]
What does a discoverable credential make possible that a non-discoverable one does not?

9.[3p]
Why has the signature counter largely stopped detecting cloned credentials?