What is FIDO Hybrid Transport (formerly caBLE) in WebAuthn and Passkeys?

FIDO Hybrid Transport (Client-to-Authenticator Protocol CTAP 2.2) enables Cross-Device Authentication (CDA). When a user attempts to sign in on a desktop computer using a passkey stored on their mobile phone, the desktop displays an encrypted QR code. Scanning the QR code establishes an end-to-end encrypted tunnel via an untrusted cloud relay server, paired with Bluetooth Low Energy (BLE) proximity detection to prove both devices are in the same physical room.

How does BLE proximity detection prevent remote phishing attacks during QR code sign-in?

If a remote adversary attempts an Adversary-in-the-Middle (AiTM) phishing attack by streaming or screenshotting the QR code over video chat, the victim might scan the QR code from across the internet. Hybrid transport defeats this by requiring the phone to broadcast an ephemeral Bluetooth Low Energy (BLE) beacon containing a cryptographic hash of the session secret. The desktop browser scans for this local BLE radio signal; if no signal is received within wireless proximity (~10 meters), authentication aborts.

How does the Noise Protocol framework encrypt cross-device passkey traffic?

The communication between desktop browser and phone is encrypted using the Noise Protocol Framework (specifically Noise_NK_25519_ChaChaPoly_SHA256). Even though WebSockets pass through third-party cloud routing relays (such as Google or Apple push servers), the relay sees only opaque AEAD ciphertext. The relay server cannot inspect the WebAuthn challenge, credential ID, or cryptographic assertions.

What are the authenticatorData bitmask flags (UP, UV, BE, BS) in WebAuthn passkeys?

The authenticatorData byte contains critical state flags: User Present (UP, bit 0) confirms physical user touch; User Verified (UV, bit 2) confirms biometric authentication (FaceID/Fingerprint) or device PIN; Backup Eligibility (BE, bit 3) denotes whether the credential can be synced to cloud keychains; and Backup State (BS, bit 4) indicates whether the passkey is currently backed up to multi-device sync (e.g. iCloud Keychain or Google Password Manager).

Passkey Cross-Device Authentication & Hybrid Transport Studio

Verified Specification | Standardized Formulas | Instant Precision

Secure & Private (Zero Data Retention) Free Access • No Sign-Up

Passkey Cross-Device Authentication Studio

Interactive FIDO2 / CTAP 2.2 simulator modeling hybrid QR pairing, BLE proximity beacons, Noise E2EE tunnels, and biometric passkey signatures.

FIDO2 / CTAP 2.2

Current Authentication Step

Simulate Phishing Threat

Passkey Storage Type

Protocol Phase

1. QR Code Displayed

Desktop awaiting camera scan

BLE Proximity Check

DETECTED (-58 dBm)

Physical co-location confirmed

Noise E2EE Tunnel

Noise_NK Established

ChaCha20-Poly1305 encrypted

Biometric Verification

FaceID / Fingerprint (UV=1)

flags: 0x1d (UP=1, UV=1, BE=1, BS=1)

FIDO Cross-Device Hybrid Handshake Flow ● Step 1 of 4 Active

WebAuthn CDA Client Invocation (JS)

AuthenticatorData Bitmask & Noise Math

Passkey Cross-Device Authentication Studio

🔍 Companion Workbenches & Verification Tools

FIDO2 CTAP2, WebAuthn & Hardware Security Key Protocol Studio

Plonky3 Goldilocks & BabyBear Prime Field Studio | Small-Field Fast ZK Proving

Confidential Computing, AMD SEV-SNP & Intel SGX/TDX Enclaves Studio

DNSSEC Validation & Trust Chain Inspector Studio

Why Smart Users Are Switching to This Free Toolkit

The Browser Feature Most People Never Use

Stop Paying for Software You Can Get Free

File Conversion Tricks That Save Hours Every Week

This Free Tool Replaced 5 Paid Apps for Our Team

What Your Browser Can Do Without Any Extensions