Offline Workstation logon with YubiKeys
A randomly-generated challenge/response secret is associated to each YubiKey, and gets programmed into a YubiKey's second identity slot (this option is called “support offline logins” in the admin UIs, and “AuthLite Challenge/Response” in the Key Programmer app.)
The HMAC-SHA1 challenge/response is checked before letting the user log in. For normal online logons, this challenge/response secret is retrieved from the domain controller and synchronized to the workstation. It is not necessary for the YubiKey to be plugged in directly to the workstation (it can operate as a remote keyboard e.g. with RDP or virtual machines).
During “offline logons”, the AuthLite software communicates directly with the plugged-in YubiKey to do the challenge/response procedure. Any (properly programmed) YubiKey that has previously been used to log in online at this workstation will also be able to log in with offline mode.
Ramifications for YubiKeys
Programming YubiKeys to support AuthLite offline logons will “use up” both identity slots in the YubiKey, and destroy any other (old) information that was previously loaded onto the key.
The first identity slot will contain the one-time passcode identity for entering OTPs as keystrokes. This identity is triggered each time the gold contact on the key is pressed. The OTPs generated can be used to log in to any AuthLite-aware system or network.1
The second identity slot will contain a challenge/response secret that gets automatically used by AuthLite when logging in to workstations that are offline from the domain.
1 Provided the intermediate software supports long enough username/password values. AuthLite OTPs are normally 64 characters. They can be programmed shorter but will in all cases be at least 34 characters long (that shortest length would support a maximum of 255 keys in your whole domain.)