Contemplating using YubiKey’s challenge-response feature to hash public passphrases.
By public, I mean an attacker could potentially exfiltrate passphrases but, not having YubiKey*, passphrases would be useless.
Is such as scheme secure in 2022 and is it quantum-computing safe?
Thanks for helping out!
*HMAC is computed on YubiKey using secret stored on secure element.