What it is
CTAP 2.1 keys can hold a small, key-global large-blob array: a place where relying parties stash data that is too big to live inside a credential ID (an SSH certificate, for example). keyroost surfaces it in the Storage sub-view of the FIDO2 tab, showing every stored entry and letting you keep your own text notes alongside.
The array is readable by anyone holding the key — no PIN is needed to read it — and it is meant for relying-party-encrypted data, not a place for plaintext secrets. Treat it as a convenience scratchpad, not a vault.
Where to find it
Open the FIDO2 tab and choose the Storage tab. It
appears only when the key reports largeBlobs support in its
getInfo options. The array loads automatically when you open the tab;
Reload refreshes it on demand. Reading needs no PIN, but adding,
editing, or deleting entries does — those are writes.
What you can do
View entries. Each stored entry is shown as a card. View bytes expands a side-by-side hex + ASCII dump of its contents. Genuine relying-party entries are labelled relying-party data and are read-only — they are encrypted by the website that created them, so keyroost never rewrites them.
Add a note. The Add button opens a composer; type text and save it. keyroost stores it as its own entry, marked so it can be recognised and read back here later. This is not encryption — the text is stored in the clear.
Edit a note. keyroost's own notes have an Edit button that replaces the text in place. Relying-party entries cannot be edited.
Delete an entry. Any entry can be deleted; keyroost rewrites the array without it.
How writes stay safe
The large-blob array is not a flat byte buffer: it is a CBOR array of entries followed by a 16-byte truncated SHA-256 checksum over the whole serialization. A naive raw edit that left a stale checksum would make the key reject the array, and could break future credential writes until a reset.
keyroost therefore edits the array structurally — it parses the entries, applies your add / edit / delete, then re-serializes and recomputes the checksum before writing. Each write re-reads the key's current array first, so concurrent relying-party entries are preserved. Writes are authenticated with a Large-Blob-Write token derived from your PIN.
Cautions
Nothing here is secret. Anyone who plugs in the key can read the array, including your notes. Don't store passwords, recovery codes, or anything sensitive. If a write is rejected, the key may be out of large-blob storage or busy; keyroost reports the CTAP status with a readable hint, and the array is left unchanged.