| Subject: | Identity may not always bge first 12 characters |
While I've never seen a response that doesn't have the identity as the
first 12 characters in the OTP the specification says that the identity
"is the initial 2-16 modhex characters of the OTP".
This is from:
http://code.google.com/p/yubikey-val-server-php/wiki/GettingStartedWritingClients
With that in mind, I'd suggest future-proofing yourself by tweaking the
substr() to be:
my $yubi_id = substr($otp, 0, -32);