Title: Hi HN,<p>I&#x27;ve been reading up on YubiKeys, which seem to be well-regarded on HN. When doing my own research, I discovered that the default authentication method requires a copy of the private key to be stored on a validation server[1] (YubiCloud, by default). This can be changed to a private validation server, however that would also need to have a copy of the private key in order to work.<p>My question is: why is this necessary at all? Surely the same functionality could be achieved with public-key cryptography rather than requiring the private key to be uploaded[2] to a validator.<p>[1] https:&#x2F;&#x2F;docs.yubico.com&#x2F;yesdk&#x2F;users-manual&#x2F;application-otp&#x2F;yubico-otp.html
[2] https:&#x2F;&#x2F;upload.yubico.com&#x2F;
Upvote: