Yubico Forum

Re: [QUESTION] how to implement validation in PHP?

2013-06-17T11:42:42+01:00

You can use YubiRADIUS as alternative

https://www.yubico.com/products/service ... ubiradius/

Statistics: Posted by Tom — Mon Jun 17, 2013 11:42 am

Re: [QUESTION] how to implement validation in PHP?

2013-06-17T10:34:04+01:00

Thanks for the hints, I'll download them and study them right away.

Statistics: Posted by mtassinari — Mon Jun 17, 2013 10:34 am

Re: [QUESTION] how to implement validation in PHP?

2013-06-17T10:14:18+01:00

You need this:
https://github.com/Yubico/php-yubico

and this:
https://github.com/Yubico/yubikey-val

and this if you do not have a HSM:
https://github.com/Yubico/yubikey-ksm

Statistics: Posted by Tom — Mon Jun 17, 2013 10:14 am

[QUESTION] how to implement validation in PHP?

2013-06-06T15:32:15+01:00

Hi again,

I am trying to understand how to implement OTP validation in a PHP web application which has no internet access, so it must not use the online Yubico validation server.

I am not much concerned with the actual code, rather with the logical flow validation must follow.

Suppose that a YubiKey is configured as follows:

Code:

Public ID: dd kg ub uh uh rv
Private ID: 54 e6 a5 4a cd 40
AES Key: b3 e1 86 d6 89 39 cb 99 8b 73 be 4b 8a 21 23 b9

And that the web-app recieves the following OTP:

Code:

ddkgubuhuhrvnclikhifnkbeifiuihdkkbcdgrlubvdg

How do I then proceed validating it?

Until now, here is what I have done:

1. split the OTP in Public ID (ddkgubuhuhrv) and actual OTP (nclikhifnkbeifiuihdkkbcdgrlubvdg)
2. convert OTP from ModHex to binary, by first "translating" it to standard hexadecilmal and then to binary
3. decode the binary using the AES key, obtaining a new binary string

But now, how do I go on?

I have read the manual that I should perform a CRC16 check, so I found a PHP implementation of it, but on which string should I call it? And after that?

Thanks in advance for your help.

Statistics: Posted by mtassinari — Thu Jun 06, 2013 3:32 pm