Radiator Server Documentation — v10.33.1

YubiKey Context Variables

Context variables for Yubico OTP offline authentication

Table of Contents

yubikey Context Variables

Backends populate these variables before the yubikey action runs. After successful authentication the action updates yubikey.counter and yubikey.session; persist them to prevent replay attacks.

VariableTypeRequiredDescription
yubikey.secretBinary (16 bytes)YesAES-128 key for offline decryption. Must be stored as a BLOB, not hex text.
yubikey.publicString (12-char modhex)NoExpected public UID. Rejects OTPs from other tokens when set.
yubikey.privateInteger (48-bit)NoExpected private UID inside the encrypted payload. Second identity check.
yubikey.counterInteger (16-bit)NoLast accepted usage (power-on) counter. Enables replay detection.
yubikey.sessionInteger (8-bit)NoLast accepted session (button-press) counter within a power cycle.
Table of Contents
Navigation
Home
Related
Navigation
Home
Related