YubiKey has nice explanation of this [1], it doesn't even store the usernames or anything per service. It just has single symmetric key, from which it derives t

YubiKey has nice explanation of this [1], it doesn't even store the usernames or anything per service. It just has single symmetric key, from which it derives the stuff. It works like this (WebAuthn non-resident keys): 1. YubiKey contains symmetric key. 2. When you register to WebAuthn service it generates random private key/public key, encrypts the private key with symmetric key, and sends this as token to server. Along with your username and newly generated public key. 3. When you login to WebAuthn service and type your username you get back the token. YubiKey then decrypts the token to get the private key, and answers to the challenge server gives in public key. In other words, you don't need to store the public/private keys at all, all you need on the client side (YubiKey) the symmetric key. The private keys are stored on server you login. For WebAuthn resident keys it needs to store info, more here: https://developers.yubico.com/U2F/Protocol_details/Key_generation.html https://developers.yubico.com/U2F/Protocol_details/Key_gener...