I've been reading up on Yubico's implementation of U2F. What I understand so far is that two things are calculated. So upon registration first you calculate a private key by
$PrivateKey = HMAC(AppID+nonce,DeviceKey)$
This is then used to simulate the encrypted private key which is sent to the server in the U2F spec:
$KeyHandle = nonce, HMAC(AppID,PrivateKey)$
with "normal" U2F, you send the encrypted private key and a public key to the server. When a user authenticates, he is sent his encrypted private key and a challenge, which is some value encrypted with the public key. If the user can decrypt the challenge by decrypting the private key and decrypting the challenge he has proven he is in fact who he claims to be.
Now this is where it gets fuzzy for me.
- The keyhandle is just a nonce and HMAC concatenated, how is this turned into a private key?
- How is the public key derived as the private key is just a hash in this case?