FIDO2 passkeys and security keys¶
Unlock the device and use a standard WebAuthn client to register a USB security key on a test account. Read the service and account on the OLED before confirming. Sign out, sign in with the key, then repeat while refusing the request.
CTAP 2.1 implements clientPIN, credentialManagement, credProtect, largeBlobs and hmac-secret. U2F is also implemented. Client support varies; the protocol reference defines the exact profile.
Manage identities under Authentication → Passkeys → Services. The device PIN and FIDO PIN are distinct. Discoverable passkeys participate in encrypted backups and must not be described as non-exportable.
For OpenSSH with a FIDO-enabled client:
Use a fresh filename. Registration with a remote service or SSH server is a separate host operation. Read the English guide or French guide for management and deletion.