An enterprise identity administrator is enforcing phishing-resistant multi-factor authentication (MFA) for privileged accounts. What is the correct sequence of events for registering a FIDO2 WebAuthn hardware security key with the Identity Provider (IdP)? Place the steps in chronological order from first to last.
- 1The Identity Provider (IdP) issues a registration request containing a unique cryptographic challenge nonce to the client browser.
- 2The user interacts with the hardware security key, prompting the device to generate an asymmetric key pair bound to the origin domain.
- 3The security key signs the cryptographic challenge with its private key and sends the signed payload, public key, and attestation data back to the IdP.
- 4The IdP validates the signature against the challenge, verifies the attestation certificate, and stores the public key in the user's IAM profile.
Cevap
The correct registration sequence begins with the IdP issuing a cryptographic challenge nonce to the client browser. Next, the user touches the hardware key to generate an origin-bound asymmetric key pair on the device. Then, the security key signs the challenge and returns the signature, public key, and attestation data to the IdP. Finally, the IdP validates the attestation statement and registers the public key to the user's IAM account profile.
The correct sequence follows the standard FIDO2/WebAuthn registration ceremony. First, the Identity Provider initiates the process by issuing a cryptographic challenge nonce to the browser. Second, upon user presence confirmation, the hardware token generates an origin-bound asymmetric key pair. Third, the token signs the challenge with the private key and returns the public key and attestation payload. Fourth, the Identity Provider verifies the attestation and signature before persisting the public key in the user's IAM profile.
Adım Adım Çözüm
Anahtar Kavram
FIDO2/WebAuthn Enrollment Ceremony and Cryptographic Credential Binding