The secret is generated by a PC using Yubico's tools (see the screenshots in the PR). If you're truly paranoid you'd do this on an offline computer so that the secret doesn't some how leak to the Internet. This secret could then be programmed to other YubiKeys if desired (at least 2 are recommend for backup).

Every time the KeePass2 database is written, a new master seed is generated[1]. The master seed is stored raw in the header of the KeePass2 database so that it can be read later for decryption.

This pull request is a nutshell submits the master seed as a challenge to the YubiKey which replies with a deterministic response. We then use the response to generate the final key. The final key is the true encryption key and the file is written out. To decrypt[2], we do the same thing, but read the master seed from the header file. Commit that ties everything in to the final key[3].

[1] https://github.com/keepassx/keepassx/blob/master/src/format/... [2] https://github.com/keepassx/keepassx/blob/master/src/format/... [3] https://github.com/kylemanna/keepassx/commit/45d2add8a3037c3...