Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at the Validation Server.
The official YubiKey Validation Server source code is written in a language I'm not entirely familliar with, and would rather read a specification. And from what I can tell it isn't based on HOTP RFC 4226; TOTP RFC, like Google Authenticator.
Can anyone explain how this server works(and corresponding device keys) work from an encryption perspective?