Information Security Stack Exchange is a question and answer site for information security professionals. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at the Validation Server.

The official YubiKey Validation Server source code is written in a language I'm not entirely familliar with, and would rather read a specification. And from what I can tell it isn't based on HOTP RFC 4226; TOTP RFC, like Google Authenticator.

Can anyone explain how this server (and corresponding device keys) work from an encryption perspective?

share|improve this question

Both the validation server and Yubikey OTP use a uniquely-structured AES-encrypted key for validation. The security information about the Yubico Validation server and YubiKey OTP is available here:

You can also discuss the validation server with other users on the yubico forums, here:

-David Maples
Yubico Technical Support

share|improve this answer
Hello David, welcome to security.SE! It is great that you directly indicate your affiliation, but in contrast to a forum we prefer putting this in the "About me" section of the user section instead - that way it will always be up to date (and when you have gained 1000 rep, the text will be shown when hovering over your user icon: – Tobias Kienzler Mar 20 '13 at 13:01

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.