Yubico Forum

I have some troubles verifying the response from the Yubico server.

The response I get is something like this (REPLAYED_OTP is ok, I'm fooling around)

What I do is the following:

1. base 64 decode the hash which gives me (200 251 11 162 215 23 249 83 136 63 243 146 149 88 139 170 195 11 151 135)
2. compute the verification line which is in this case "s=REPLAYED_OTP&t=2008-10-05T09:17:26Z0459". It's all ASCII so it's the same in UTF-8.
3. compute the HMAC-SHA1 hash over the verification line using my shared secret and compare it with hash from the first step. They don't match.

I also sign my requests and the server does verify them. If I attach a wrong signature the server complains with BAD_SIGNATURE. So I think my HMAC-SHA1 library is ok. My first guess would be that my verification line is bad.

The hmac calc has not been working well for awhile in the validation response.

So I'm migrating it to the new server at:

http://63.146.69.105/wsapi/verify.php?id=1&otp=...

Let me know if you have problems with the new server?

Thanks

_________________
The YubiKey Server Guy

Yes, now requests that previously returned OK now return BAD_SIGNATURE. I tried to use it without the h parameter but then I get MISSING_PARAMETER info=h.

Philippe, you can turn on/off of signature & id checking at our new validation server in beta:

http://63.146.69.105/yms/

And, you can use this to test the generated signature:

http://63.146.69.105/wsapi/sign_demo.php

To validate an OTP:

Debug mode: http://63.146.69.105/wsapi/verify_debug ... ....&h=....

Production mode: http://63.146.69.105/wsapi/verify?id=...&otp=....&h=....

This beta server's database is used only for testing purpose, NOT the same as the production database behind the server at http://api.yubico.com.

Thanks for comments

_________________
The YubiKey Server Guy

We have some clients that perform signing/validation of signatures, check the yubico.com web pages. Maybe you can debug some of them to find out what is going on with your implementation? I think they are supposed to work with our current server.

/Simon