That's very cool. Could you elaborate on the method in which the key accepts the challenge? I was under the impression that a Yubikey only acted as a USB keyboard - which ensured it's security by isolation.
The general protocol is U2F:
https://developers.yubico.com/U2F/
Yubico has some python code here:
https://github.com/Yubico/python-u2flib-host
https://github.com/Yubico/python-u2flib-server
Chrome builds U2F into the browser itself for website authentication.
Re:Yubikey with USB-C
by emilecantin on Thursday January 05, 2017 @01:16PM
(#13329696)
I've built a node.js version if Python is not your chosen stack: https://github.com/emilecantin/node-u2flib-server
Another choice that looks (sadly, for me) more popular: https://github.com/ashtuchkin/u2f
I believe they're describing U2F, and share your perception that at some point in the past these were just keyboards.
[1] describes the flow at a high level, and [2] goes into more details
[1]: https://www.yubico.com/about/background/fido/
[2]: https://developers.yubico.com/U2F/Protocol_details/Overview....
The other answers are correct, but even before U2F the yubikey supported other methods as well. The have a classic HMAC based ChallengeResponse-Mode, a smartcard and PIV interface.
I believe this adds protection against phishing because the browser communicates which origin (that is, which domain name) is sending the challenge, and that gets hashed into the signed response. So if trust-me-im-google.com proxies google.com, it can ask you for a one-time password, and the one-time password will be valid when google.com gets it, so the MITM can get your login cookie. But if you're using U2F, the signed response will say "Yes, I would like to authenticate to trust-me-im-google.com", and google.com will reject that.