Yubico Forum

I try to setup Challenge-Response Authentication for local pam_yubico usage (and keepassx and maybe even dm-crypt). I wold like to have a backup copy of the key stored on an external medium at a safe location in case my yubikey breaks. So far this all works fine. As long as I just use ykpersonalize I can recreate the same key with the -a option and if I just use yubikey-personalization-gui I can also recreate the same key by entering the same string into the appropriate GUI input field.
But while the key format looks the same in both applications if I enter the key displayed by ykpersonalize into the input field in the GUI or if I use the GUI key on the ykpersonalize command line this does not produce the same key.
Does anyone know how the keys are encoded and how the key displayed by ykpersonalize needs to be transformed to produce the same key when entered into the GUI or vice-versa.

Are you using the hmac-lt64 option ?

When this option is in effect the challenge is limited to 63 bytes, but may be less and any challenge longer than 63 bytes will be truncated to 63.

Yes the hmac-lt64 is set in both cases. So no difference there. AFAIK this is needed for the pam_yubico challenge-response mode to work at all.