> But since U2F/FIDO2 devices need to derive secret keys at runtime to be able to work with an unlimited number of services, the ATECC508A doesn’t work out well

> But since U2F/FIDO2 devices need to derive secret keys at runtime to be able to work with an unlimited number of services, the ATECC508A doesn’t work out well. This is because to derive a key at runtime, you typically need to compute an HMAC that’s keyed with a master secret, and store the result as the runtime key. This needs multiple interactions with the ATECC508A and requires the runtime key be stored temporarily on the MCU, which tarnishes the idea of key isolation. This is incorrect. The atec family can derive keys using a static master seed and variable nonce. Such keys are derived internally and kept internally, never leaving the chip. By storing a single derivation master secret, you can use the hashed u2f appid as the nonce. I would additionally have a 2nd hmac secret to apply to the nonce, and use that as the key derivation nonce rather than the appid directly.