---
name: "fido_dev_largeblob_get"
section: "3"
platform: "linux"
package: "libfido2"
version: "1.17.0-1"
release: "Arch Linux 2026-11-01"
platforms: ["linux"]
url: "https://new.carta.tech/fido_dev_largeblob_get"
---

# fido\_dev\_largeblob\_get(3)

FIDO2 large blob API

## NAME

**fido\_dev\_largeblob\_get**, **fido\_dev\_largeblob\_set**, **fido\_dev\_largeblob\_remove**, **fido\_dev\_largeblob\_get\_array**, **fido\_dev\_largeblob\_set\_array** – FIDO2 large blob API

## SYNOPSIS

**#include \<fido.h\>**

*int*\

**fido\_dev\_largeblob\_get**(*fido\_dev\_t \*dev*, *const unsigned char \*key\_ptr*, *size\_t key\_len*, *unsigned char \*\*blob\_ptr*, *size\_t \*blob\_len*);

*int*\

**fido\_dev\_largeblob\_set**(*fido\_dev\_t \*dev*, *const unsigned char \*key\_ptr*, *size\_t key\_len*, *const unsigned char \*blob\_ptr*, *size\_t blob\_len*, *const char \*pin*);

*int*\

**fido\_dev\_largeblob\_remove**(*fido\_dev\_t \*dev*, *const unsigned char \*key\_ptr*, *size\_t key\_len*, *const char \*pin*);

*int*\

**fido\_dev\_largeblob\_get\_array**(*fido\_dev\_t \*dev*, *unsigned char \*\*cbor\_ptr*, *size\_t \*cbor\_len*);

*int*\

**fido\_dev\_largeblob\_set\_array**(*fido\_dev\_t \*dev*, *const unsigned char \*cbor\_ptr*, *size\_t cbor\_len*, *const char \*pin*);

## DESCRIPTION

The “largeBlobs” API of *libfido2* allows binary blobs residing on a CTAP 2.1 authenticator to be read, written, and inspected. “largeBlobs” is a CTAP 2.1 extension.

“largeBlobs” are stored as elements of a CBOR array. Confidentiality is ensured by encrypting each element with a distinct, credential-bound 256-bit AES-GCM key. The array is otherwise shared between different credentials and FIDO2 relying parties.

Retrieval of a credential's encryption key is possible during enrollment with [fido\_cred\_set\_extensions(3)](/fido_cred_set_extensions/3.md) and [fido\_cred\_largeblob\_key\_ptr(3)](/fido_cred_largeblob_key_ptr/3.md), during assertion with [fido\_assert\_set\_extensions(3)](/fido_assert_set_extensions/3.md) and [fido\_assert\_largeblob\_key\_ptr(3)](/fido_assert_largeblob_key_ptr/3.md), or, in the case of a resident credential, via *libfido2's* credential management API.

The “largeBlobs” CBOR array is opaque to the authenticator. Management of the array is left at the discretion of FIDO2 clients. For further details on CTAP 2.1's “largeBlobs” extension, please refer to the CTAP 2.1 spec.

The **fido\_dev\_largeblob\_get**() function retrieves the authenticator's “largeBlobs” CBOR array and, on success, returns the first blob (iterating from array index zero) that can be decrypted by *key\_ptr*, where *key\_ptr* points to *key\_len* bytes. On success, **fido\_dev\_largeblob\_get**() sets *blob\_ptr* to the body of the decrypted blob, and *blob\_len* to the length of the decrypted blob in bytes. It is the caller's responsibility to free *blob\_ptr*.

The **fido\_dev\_largeblob\_set**() function uses *key\_ptr* to encrypt *blob\_ptr* and inserts the result in the authenticator's “largeBlobs” CBOR array. Insertion happens at the end of the array if no existing element can be decrypted by *key\_ptr*, or at the position of the first element (iterating from array index zero) that can be decrypted by *key\_ptr*. *key\_len* holds the length of *key\_ptr* in bytes, and *blob\_len* the length of *blob\_ptr* in bytes. A *pin* or equivalent user-verification gesture is required.

The **fido\_dev\_largeblob\_remove**() function retrieves the authenticator's “largeBlobs” CBOR array and, on success, drops the first blob (iterating from array index zero) that can be decrypted by *key\_ptr*, where *key\_ptr* points to *key\_len* bytes. A *pin* or equivalent user-verification gesture is required.

The **fido\_dev\_largeblob\_get\_array**() function retrieves the authenticator's “largeBlobs” CBOR array and, on success, sets *cbor\_ptr* to the body of the CBOR array, and *cbor\_len* to its corresponding length in bytes. It is the caller's responsibility to free *cbor\_ptr*.

Finally, the **fido\_dev\_largeblob\_set\_array**() function sets the authenticator's “largeBlobs” CBOR array to the data pointed to by *cbor\_ptr*, where *cbor\_ptr* points to *cbor\_len* bytes. A *pin* or equivalent user-verification gesture is required.

## RETURN VALUES

The functions **fido\_dev\_largeblob\_set**(), **fido\_dev\_largeblob\_get**(), **fido\_dev\_largeblob\_remove**(), **fido\_dev\_largeblob\_get\_array**(), and **fido\_dev\_largeblob\_set\_array**() return FIDO\_OK on success. On error, an error code defined in ⟨fido/err.h⟩ is returned.

## SEE ALSO

[fido\_assert\_largeblob\_key\_len(3)](/fido_assert_largeblob_key_len/3.md), [fido\_assert\_largeblob\_key\_ptr(3)](/fido_assert_largeblob_key_ptr/3.md), [fido\_assert\_set\_extensions(3)](/fido_assert_set_extensions/3.md), [fido\_cred\_largeblob\_key\_len(3)](/fido_cred_largeblob_key_len/3.md), [fido\_cred\_largeblob\_key\_ptr(3)](/fido_cred_largeblob_key_ptr/3.md), [fido\_cred\_set\_extensions(3)](/fido_cred_set_extensions/3.md), [fido\_credman\_get\_dev\_rk(3)](/fido_credman_get_dev_rk/3.md), [fido\_credman\_get\_dev\_rp(3)](/fido_credman_get_dev_rp/3.md), [fido\_dev\_get\_assert(3)](/fido_dev_get_assert/3.md), [fido\_dev\_make\_cred(3)](/fido_dev_make_cred/3.md)

## CAVEATS

The “largeBlobs” extension is not meant to be used to store sensitive data. When retrieved, a credential's “largeBlobs” encryption key is transmitted in the clear, and an authenticator's “largeBlobs” CBOR array can be read without user interaction or verification.