phpsec/phpSec — Issue #76: phpsecYubikey::validOtp() needs work
Author: xqus
Created: 2011-12-19 20:27:52+00:00
State: open

YubiKey OTPs consists of 32-48 characters in the ModHex alphabet "cbdefghijklnrtuv". Unfortunately, this has turned to be over-aggresive because if the keyboard layout is Dvorak-based, it will look differently. For example, the modhex alphabet in the US Dvorak layout is "jxe.uidchtnbpygk". There are other Dvorak layouts as well. For this reason, our recommendation is that clients only check that the input consists of 32-48 printable characters.

http://code.google.com/p/yubikey-val-server-php/wiki/GettingStartedWritingClients