• Mars@lemmy.ca
    link
    fedilink
    English
    arrow-up
    2
    ·
    1 year ago

    Well, it’s a full keypair being stored: Authenticators like Bitwarden need to first provide the public key to the relying party (RP) so the RP can issue the encrypted auth challenge. The challenge then is handed back to the authenticator, user verification happens, then the challenge is signed by the private key and sent back to the RP for verification to complete the auth ceremony.