safeword challenge

Hi, there are some servers here at work which issue a Safeword challenge after I login. Can anyone tell me exactly how the challenge/response system works? In particular, how are the valid keys decided?

I take it this is using the hardware passkey generator?

Yes. I input a 4 digit key on the card, this prints a 6 digit key on the display, and I input that at the safeword prompt to finally get my shell.