How does pwSafe use the YubiKey?

pwSafe uses YubiKey's HMAC-SHA1 challenge response mode. When the key is initialized, a random secret is stored in it. The password you enter is used as the challenge and the resulting response is used as the safe password.

To ease the creation of backups keys, the secret is also stored in encrypted form inside the safe itself.