2fa on Learning Journey of Alexander Allgäuer

YubiKey: HMAC-SHA1 Challenge-Response

Mon, 13 Apr 2026 00:00:00 +0000

Configure HMAC-SHA1 Challenge-Response on a YubiKey’s second OTP slot.

Check slot status

Use ykman otp info to make sure your second slot isn’t already used. Slot 1 is typically reserved for Yubico OTP.

ykman otp info
# Slot 1: programmed
# Slot 2: empty

Configure OTP slot 2

Generate a shared secret and program both YubiKeys (primary + backup) with the same secret so either can open the database.

SECRET=$(openssl rand -hex 20)
ykman otp chalresp --touch 2 $SECRET # Key 1
ykman otp chalresp --touch 2 $SECRET # Key 2
unset SECRET

The --touch flag is optional, but when you think about it, it absolutely makes sense — you want physical presence confirmation before the key responds.

YubiKey: Introduction

Mon, 13 Apr 2026 00:00:00 +0000

YubiKey is a hardware security key manufactured by Yubico.

YubiKeys support a wide range of authentication standards, including:

FIDO2 / WebAuthn
FIDO U2F
Smart card (PIV)
OpenPGP
OATH-TOTP / HOTP
Yubico OTP

Rule #1: Always buy two

When ordering a YubiKey, always put two of them in the shopping cart. Saving a few bucks on a backup key can leave you with a single point of catastrophic failure. They come with a hole that lets you attach one to your keychain while the other stays in another safe, trusted location.

YubiKey: Management Tool

Mon, 13 Apr 2026 00:00:00 +0000

Yubikey Management Tools Installation

We need yubikey-manager Smart Card Daemon middlware.

sudo pacman -S yubikey-manager pcsclite ccid
sudo systemctl enable --now pcscd.service
sudo systemctl enable --now pcscd.socket

Verify if the key is detected:

ykman info

 @slexi  ykman info 
Device type: YubiKey 5C NFC
Serial number: 25997589
Firmware version: 5.4.3
Form factor: Keychain (USB-C)
Enabled USB interfaces: OTP, FIDO, CCID
NFC transport is enabled

Applications USB NFC 
Yubico OTP Enabled Enabled
FIDO U2F Enabled Enabled
FIDO2 Enabled Enabled
OATH Enabled Enabled
PIV Enabled Enabled
OpenPGP Enabled Enabled
YubiHSM Auth Enabled Enabled