I read the open source multifactor authentication techniques called
HOTP RFC 4226 and
TOTP RFC 6238 and realized that a single random number is the basis for the token's cryptography... and that this number must be made secret or the multi-factor benefit is broken.
I also noticed that some of my users are using a YubiKey, an RSA Key, and a Gemalto key for Banking, VPN service, and Amazon web services respectively.
I would like to offer multi-factor authentication, but want to avoid physical token bloat for the end user. (Them carrying too many tokens)
What information would I need to reuse an existing YubiKey, RSA, or Gemalto (or any other) in my own system?
I suppose the user will need to give me the serial number (so I can derive the key material) and I will need to determine the crypto algorithm for each key.