3

Many YubiKey servers rely on the free cloud hosted authentication that comes with the product, but I'm interested in keeping all cryptographic material in my control. For that reason I am looking at the Validation Server.

The official YubiKey Validation Server source code is written in a language I'm not entirely familliar with, and would rather read a specification. And from what I can tell it isn't based on HOTP RFC 4226; TOTP RFC, like Google Authenticator.

Can anyone explain how this server (and corresponding device keys) work from an encryption perspective?

Improve this question

1 Answer 1

Reset to default
7

Both the validation server and YubiKey OTP use a uniquely-structured AES-encrypted key for validation. The security information about the Yubico Validation server and YubiKey OTP is available here.

You can also discuss the validation server with other users on the Yubico forums.

Improve this answer
2
  • Hello David, welcome to security.SE! It is great that you directly indicate your affiliation, but in contrast to a forum we prefer putting this in the "About me" section of the user section instead - that way it will always be up to date (and when you have gained 1000 rep, the text will be shown when hovering over your user icon: security.stackexchange.com/privileges/established-user)
    – Tobias Kienzler
    Commented Mar 20, 2013 at 13:01
  • The first link points to a nonexistent page. Can you update the URL?
    – user1
    Commented Mar 8, 2017 at 12:36

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .