logoalt Hacker News

ramblurr • today at 7:48 PM • 0 replies • view on HN

Your 2nd one is non-resident, the secret key material is encrypted in that sk file. But it is encrypted with a master key that is only inside your yk. So you need both your sk handle file and the yk to use it. This has the benefit of not consuming the limited number of memory slots in a yk.

In the first one the handle file that's created, can be recovered from the yk key itself, that's what resident is.

Having the only practical difference between the two is that, with the first one, you (or someone else) only needs the yk to use the credential. But in the latter case, one needs the yk and the handle file.