# Key derivation function

**URL:** <https://onlykey.discourse.group/t/key-derivation-function/986>\
**Category:** Two Factor Authentication\
**Created:** [February 4, 2023, 6:16pm UTC](https://onlykey.discourse.group/t/key-derivation-function/986 "2023-02-04T18:16:23Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![MLS69](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@MLS69](https://onlykey.discourse.group/u/MLS69)\
**Post date:** [February 4, 2023, 6:16pm UTC](https://onlykey.discourse.group/t/key-derivation-function/986/1 "2023-02-04T18:16:23Z")

</div>

Hello,  
Can someone direct me to the documentation of how Onlykey authenticates (U2F) with an website?  
Is it a 'Keyhandle" approach (as in Yubikey) where device specific secret is used to deterministically generate an unlimited amount of private keys (ECC, RSA)?

If so, is the “master key/device specific secret” generated using the CSRNG built in the OK?  
When is this secret generated (at device creation?) and what are its properties?

Is there a way to create your own master key/secret as you can with stored SSH/GPG keys or resident FIDO2 keys?

Thanks (and apologies if this question has previously been asked)

---

<div class="post-metadata">

**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\
**Post date:** [February 6, 2023, 6:19pm UTC](https://onlykey.discourse.group/t/key-derivation-function/986/2 "2023-02-06T18:19:11Z")

</div>

FIDO2 (Used to be called U2F) is a standard that supports MFA and passwordless authentication. OnlyKey works like other FIDO security keys here is more info:

> **[OnlyKey User's Guide | Docs](https://docs.onlykey.io/usersguide.html#universal-2nd-factor-u2f)**
>
> The OnlyKey user's guide provides step-by-step instructions for configuring and using OnlyKey.

> Is there a way to create your own master key/secret as you can with stored SSH/GPG keys or resident FIDO2 keys?

Yes, this is called resident keys. Its a feature of FIDO2 and used for passwordless authentication, not used for encryption/signing like GPG keys are.

---

<div class="post-metadata">

**Author:** ![MLS69](https://avatars.discourse-cdn.com/v4/letter/m/3bc359/32.png) [@MLS69](https://onlykey.discourse.group/u/MLS69)\
**Post date:** [February 8, 2023, 11:00pm UTC](https://onlykey.discourse.group/t/key-derivation-function/986/3 "2023-02-08T23:00:30Z")

</div>

I guess what I was trying to ask is what are the details of how the Onlykey is seeded with the master secret that is used to derive the unlimited amount of non-resident and 25 resident/discoverable credentials.

Also regarding resident keys, if I fill up all 25 ECC with slots with keys that I generate myself then will the Onlykey get rejected when trying to register it with a website that uses WebAuthn FIDO2 protocol as traditional U2F 2FA ?

After registering the OnlyKey to a website is there a way to export that resident key (including the private key) that’s been created by the OnlyKey?

---

<div class="post-metadata">

**Author:** ![t11](https://avatars.discourse-cdn.com/v4/letter/t/8e7dd6/32.png) [@t11](https://onlykey.discourse.group/u/t11)\
**Post date:** [February 13, 2023, 6:40pm UTC](https://onlykey.discourse.group/t/key-derivation-function/986/4 "2023-02-13T18:40:15Z")

</div>

Key derivation and the 25 ECC slots are not used for FIDO2. There are 12 FIDO2 resident key slots, this is separate from the 25 ECC slots that are used for SSH/GPG.