Meet passkeys involve a two-step process: key agreement and FIDO CTAP operations. Let's break down the process and address your questions.
Key agreement: This step uses Bluetooth Low Energy (BLE) to establish a shared secret between the two devices (phone and authenticator). During this step, the devices perform a secure key exchange, allowing them to derive a shared secret that will be used for encrypted communication.
FIDO CTAP operations: After the key agreement is completed, the two devices connect to a relay server, which acts as a bridge for their communication. At this point, the FIDO Client-to-Authenticator Protocol (CTAP) comes into play. CTAP defines how the client and authenticator communicate to perform authentication operations like creating and using credentials.
CTAP supports multiple transports for communication, such as USB, NFC, and BLE. However, since you mentioned that the devices connect to a relay server, it is likely that the CTAP communication is using Transmission Control Protocol (TCP) over the internet rather than Bluetooth.
If you turn off Bluetooth after the key agreement is finished, the communication between the two devices might still work as long as the devices have established a connection to the relay server via another transport like TCP. However, it's essential to ensure that the devices are connected to the internet via Wi-Fi or mobile data.
Once the devices are connected to the relay server, CTAP messages are exchanged between the client and authenticator. These messages include requests for creating credentials, signing, and various other operations. The relay server facilitates the exchange of these messages without being able to decrypt the content, as the communication is encrypted using the shared secret established during the key agreement process.
In summary, after the key agreement is completed using Bluetooth, the devices connect to a relay server, and FIDO CTAP operations are performed. The communication between the devices is encrypted and typically uses TCP over the internet. Turning off Bluetooth after the key agreement should not affect the CTAP communication as long as the devices are connected to the internet.
