I do not specifically resolve any of the original questions here concerning the purpose of Yubikey with Password Safe, but I think the experiment I performed can shed some light on the situation.
I have confirmed that @Kousha is correct: the Yubikey response simply becomes the static password.
Verify as described below. (I wanted to provide the following code to help the poster at Password Safe on Source Forge, but I do not have an account to do so.)
Password Safe Yubikey Responses from the Secret Key
A Yubikey response may be generated in a straightforward manner with HMAC-SHA1 and the Yubikey's secret key, but generating the Password Safe Yubikey response is a bit more involved because of null characters and operating system incompatibilities. (Essentially, one has to insert a null byte between every original byte in the challenge.) In addition, Yubikey challenges get parsed. In short, on a Linux computer, if key stores the Secret Key in hexadecimal form with 40 hexits and message stores the challenge, then the following command should return the Password Safe Yubikey response:
printf $message |
xxd -p | sed 's/../&00/g' |
sed 's/00$//' | cut -c -63 | xxd -r -p |
openssl dgst -sha1 -mac HMAC -macopt "hexkey:$key" -binary |
xxd -p
If possible, you might want to write a temporary Secret Key onto the Yubikey and use a challenge other than your real password for the verification—I am not familiar with how computers store variables or other related security issues. (I'd be happy to learn if anyone has knowledge about this.) You could at least hide the typed characters using stty. The following script prompts for the Secret Key and challenge without displaying them, and then outputs the Password Hash Yubikey response.
#!/usr/bin/env bash
stty -echo
printf "shared secret key (40 hexits): "
read HMACSHA1_key
if [ -z "$HMACSHA1_key" ]; then
stty echo
printf '\n Empty input. Exiting.\n'
exit 1
fi
if [ ${#HMACSHA1_key} -ne 40 ]; then
stty echo
printf '\n Need exactly 40 characters. Exiting.\n'
exit 1
fi
HMACSHA1_no_space="${HMACSHA1_key/ /}"
if [ ${#HMACSHA1_no_space} -ne 40 ]; then
stty echo
printf '\n No spaces. Exiting.\n'
exit 1
fi
HMACSHA1_key_mod_hex=$(printf "$HMACSHA1_key" | sed 's/\([0-9]\|[a-f]\|[A-F]\)//g')
if [ -n "${HMACSHA1_key_mod_hex}" ]; then
stty echo
printf '\n Invalid characters: %s\n' "${HMACSHA1_key_mod_hex}"
printf '\n Only 0-9, a-f, A-F allowed. Exiting.\n'
exit 1
fi
printf "\n"
printf "message/challenge: "
read HMACSHA1_value
if [ -z "$HMACSHA1_value" ]; then
stty echo
printf '\n Empty input. Exiting.\n'
exit 1
fi
printf $HMACSHA1_value |
xxd -p | sed 's/../&00/g' |
sed 's/00$//' | cut -c -63 | xxd -r -p |
openssl dgst -sha1 -mac HMAC -macopt "hexkey:$HMACSHA1_key" -binary |
xxd -p
I cannot attest to the portability of the above command and the above script. They are pared down versions of things that worked for me, at least.
