def decrypt_yubikey_otp(self, from_key):
        """
        Try to decrypt a YubiKey OTP.

        Returns a string starting with either 'OK' or 'ERR' :

        'OK counter=ab12 low=dd34 high=2a use=0a'

        'ERR Unknown public_id'

        on YubiHSM errors (or bad OTP), only 'ERR' is returned.
        """
        if not re.match(valid_input_from_key, from_key):
            self.log_error("IN: %s, Invalid OTP" % (from_key))
            if self.stats_url:
                stats['invalid'] += 1
            return "ERR Invalid OTP"

        public_id, _otp = pyhsm.yubikey.split_id_otp(from_key)

        try:
            aead = self.aead_backend.load_aead(public_id)
        except Exception as e:
            self.log_error(str(e))
            if self.stats_url:
                stats['no_aead'] += 1
            return "ERR Unknown public_id"

        try:
            res = pyhsm.yubikey.validate_yubikey_with_aead(
                self.hsm, from_key, aead, aead.key_handle)
            # XXX double-check public_id in res, in case BaseHTTPServer suddenly becomes multi-threaded
            # XXX fix use vs session counter confusion
            val_res = "OK counter=%04x low=%04x high=%02x use=%02x" % \
                (res.use_ctr, res.ts_low, res.ts_high, res.session_ctr)
            if self.stats_url:
                stats['ok'] += 1
        except pyhsm.exception.YHSM_Error as e:
            self.log_error ("IN: %s, Validate FAILED: %s" % (from_key, str(e)))
            val_res = "ERR"
            if self.stats_url:
                stats['err'] += 1

        self.log_message("SUCCESS OTP %s PT hsm %s", from_key, val_res)
        return val_res
Try to decrypt a YubiKey OTP.

        Returns a string starting with either 'OK' or 'ERR' :

        'OK counter=ab12 low=dd34 high=2a use=0a'

        'ERR Unknown public_id'

        on YubiHSM errors (or bad OTP), only 'ERR' is returned.