Discoverable keys store identity; non-discoverable keys are lightweight. They are also known as (non-)discoverable or (non-)resident keys.

Ben's hardware key

**Useful

Most digital keychains support only discoverable keys. This means UX is consistently nice.

Hardware keys often support both options - says me, due to storage limitations.

This means that unless enforced, a hardware key may try to store a non-discoverable key, which may not function properly in certain authentication flows, where it is not possible to provide a username ahead of a credential.

Discoverable keys

Discoverable keys store details about a user and relying party on a device. These are good for user experience, UX, as they allow information to be stored locally about the user and relying party.

One limitation to this is that the user's device, if stolen, can tell the thief which sites to access and as what user.

In addition, there is often a limit to how many keys may be stored on a device/ hardware key.

Non-discoverable keys

Non-discoverable keys store only a Credential ID. The authentication service, IDP, stores a public key and the same Credential ID, plus some encrypted data called a key handle.

Due to the difference in what is stored, there is room to store significantly more non-discoverable keys on a device as they are tiny in size - bytes.

Non-discoverable keys do not offer as nice a UX, but offer more security if a key were stolen as there is no mention of where each key is used. This requires that a user must remember all usernames... but no passwords.