Examkin

Question

Difficulty: MediumIdentity and Access Management Operations

A security analyst is documenting the hardware-based multi-factor authentication (MFA) process using WebAuthn/FIDO2 for corporate cloud applications. Place the operational steps of a successful WebAuthn authentication sequence in the correct chronological order from first to last.

  1. 1The user attempts authentication, causing the Relying Party (RP) server to generate a unique cryptographic challenge.
  2. 2The Relying Party sends the challenge along with the RP identifier to the client browser's WebAuthn API.
  3. 3The user performs local verification (such as entering a PIN or biometric scan) on the hardware security key to unlock the private key and sign the challenge.
  4. 4The hardware key sends the signed assertion back to the browser, which forwards the response payload to the Relying Party server.
  5. 5The Relying Party server verifies the signed challenge using the user's previously registered public key and establishes an authenticated session.

Answer

The correct order begins with the Relying Party generating a unique cryptographic challenge upon user login initiation, sending that challenge to the client browser, performing local user verification on the hardware key to sign the challenge, forwarding the signed assertion payload back to the Relying Party server, and finally verifying the signature using the stored public key to issue an authenticated session.
The WebAuthn authentication flow follows a strict challenge-response protocol sequence: First, the Relying Party (RP) generates a cryptographic challenge upon login attempt. Second, the RP sends this challenge and session parameters to the client browser. Third, the user authenticates locally on the hardware key (via PIN or biometric), which allows the private key to sign the challenge. Fourth, the signed assertion is sent back to the client browser and submitted to the RP server. Finally, the RP server verifies the signature using the stored public key to validate identity.

Step-by-Step Solution

1
Identify the initial trigger and challenge generation.
The Relying Party server generates a random cryptographic challenge when authentication is requested.
WebAuthn authentication is challenge-response based to protect against replay attacks.
2
Trace the challenge delivery to the client.
The server transmits the challenge and RP identity parameters to the browser WebAuthn API.
The client browser acts as the intermediary between the server and the hardware authenticator.
3
Determine the hardware key user verification step.
The user completes biometric or PIN verification on the physical security key, allowing it to sign the challenge with the private key.
Local user interaction is mandatory for FIDO2 token activation.
4
Trace the transmission of the signed response.
The signed assertion is returned to the browser and forwarded to the Relying Party server.
The authenticator does not communicate directly with the server; responses pass through the web browser client.
5
Confirm final server verification and authorization.
The server verifies the cryptographic signature with the user's public key.
Server validation completes the challenge-response cycle and confirms authentic user identity.

Key Concept

FIDO2 / WebAuthn Challenge-Response Authentication Sequence
Rate this question

Topics

Identity and Access Management Operations

More questions from this topic