1) what does the auth_id do
Answer:
There are two ways to secure the OTP validation communication (request and response). The first is to use HTTPS based secure communication channel to exchange the OTP Validation request and response. The other is to authenticate the request and response with (an optional) parameter h which is the HMAC SHA1 hash generated using the shared secret Key to sign the OTP validation request and response message.
Using this h parameter, a client (i.e. an application/service making the validation request to the Yubico OTP validation server) can be sure that the response is coming from the Yubico OTP validation and has not been tampered.
To generate this h parameter a shared secret Key (referred henceforth as API Key) is used. This API Key is associated with an ID (API ID/auth_id) on the Yubico OTP validation server.
If the h parameter is present in the OTP validation request, i.e. the client has signed the request using the API Key, then at the OTP validation server the id parameter is used to extract the corresponding API Key from the database and the HMAC SHA1 hash is computed on the OTP validation request. The server generated hash is compared with the h parameter present in the OTP validation request to validate the authenticity of the OTP validation request.
Therefore, if you are using the h parameter in the OTP validation request, you need to use your corresponding API ID in the OTP validation request.
The OTP validation server always sends the h parameter in the OTP validation response. This h parameter is generated by signing the OTP validation response using the shared secret Key associated with the id in the validation request. At the client side, HMAC SHA1 hash is computed on the OTP validation response using the API Key configured on the client side (the way of configuring this on the client will be client specific). The client generated h parameter is compared with the h parameter present in the OTP validation response to validate the authenticity of the OTP validation response.
2) if i made a program that reqired a yubikey would i need to create a individual auth_ID for each one?
Answer:
You should always use a same API ID for all of your YubiKeys. There is no need to generate a different API ID for each YubiKey. The API ID concept is designed to use an API ID per site / application / service and not per YubiKey.
Let’s take an example. You have developed a web application and integrated YubiKey based strong authentication in to your web application. You are using the online Yubico OTP validation server for OTP validation and you want to use the h parameter in the OTP validation request for authenticating the validation requests and responses. Your users are using YubiKey OTP for authentication along with traditional username and password.
Now all user authentication requests will be handled by your web application. Your web application will validate the username and password and will send the OTP to the online Yubico OTP validation server by forming the OTP validation requests for every OTP received from the users. Here, your web application acts as a client to the Yubico OTP validation server.
As the web application is sending the OTP to the validation server and not the user, there is no need to create separate API ID and API Key for every YubiKey you own. You should create and use only one API ID and API Key pair for all of your YubiKeys.
We hope this helps!Statistics: Posted by network-marvels — Fri Feb 19, 2010 10:26 am
]]>