Yubico Forum

Hi again,

I am trying to understand how to implement OTP validation in a PHP web application which has no internet access, so it must not use the online Yubico validation server.

I am not much concerned with the actual code, rather with the logical flow validation must follow.

Suppose that a YubiKey is configured as follows:



And that the web-app recieves the following OTP:



How do I then proceed validating it?

Until now, here is what I have done:

1. split the OTP in Public ID (ddkgubuhuhrv) and actual OTP (nclikhifnkbeifiuihdkkbcdgrlubvdg)
2. convert OTP from ModHex to binary, by first "translating" it to standard hexadecilmal and then to binary
3. decode the binary using the AES key, obtaining a new binary string

But now, how do I go on?

I have read the manual that I should perform a CRC16 check, so I found a PHP implementation of it, but on which string should I call it? And after that?

Thanks in advance for your help.

You need this:
https://github.com/Yubico/php-yubico

and this:
https://github.com/Yubico/yubikey-val

and this if you do not have a HSM:
https://github.com/Yubico/yubikey-ksm

_________________
-Tom

Thanks for the hints, I'll download them and study them right away.

You can use YubiRADIUS as alternative

https://www.yubico.com/products/service ... ubiradius/

_________________
-Tom