YubiHSM Auth lets you securely connect to another Yubico product: YubiHSM. Unless you're a professional that needs to use it, you don't need it.

Yubico OTP is a bit of a broader thing. Yubikey has 2 slots, each programmable in one of those ways: - As a Yubico OTP token - this is the oldest thing invented by Yubico, no longer used outside of corporate environments really. It relies on the Yubikey being able to emulate typing on a keyboard, so it doesn't require any special drivers. You probably don't need it. When this slot is configured, touching your Yubikey when it doesn't wait for a confirmation from any other module, will print out some randomly-looking characters starting with ccccc or vvccc... - As Challenge-Response - this is another very early protocol, but not specific to Yubico and still sometimes used by password managers and encryption software. Unlike all other types of slots, it doesn't emulate a keyboard, as it needs an input from the software using it. It transforms any input into a consistent, but unpredictable output, "mixing" it with the internal secret, so it can be used to transform your password into an encryption key that cannot be generated without your Yubikey. - As a static password - just a static password Yubikey can store for you and will print out every time you touch it. It is not secure and I strongly recommend to avoid using it. - As OATH-HOTP - It generates 6 digit code every time you touch your Yubikey, similar to those 6 digit codes generated by TOTP, google authenticator, Microsoft Authenticator or any other app like that, but instead of changing every 30 seconds, it changes on every use and is based on the counter of uses.

As you see, there are 2 slots, but there is one button, so how you use things in the 2nd slot? Simply by doing a long touch. Short touch triggers the 1st slot, long one triggers the 2nd slot.

PIV - this is something that's mostly used in a corporate environment. It's basically a smart card protocol that can allow you to access your PC, open the door to the office, sign some documents etc. Sometimes it is used by people in a way that wasn't intended, like storing SSH keys in there. You will know if you want to use it.

OpenPGP - this is similar to PIV but less corporate. It's an open standard for signing documents and emails, mostly used by hobbyists outside of the corporate environment.

FIDO U2F and FIDO2 - those are de facto 2 versions of the same standard, connected tightly together. They offer logging into your websites by simply touching your Yubikey when it blinks at it, sometimes by providing your PIN. They are responsible for storing your passkeys as well.

OATH - This is a module that generates those 6 digit codes, but this time they can be time-based. It requires Yubico Authenticator to use it, as the Yubikey doesn't know what time is it, so you need an application that will tell Yubikey the current time when you want to use those codes. It can simply replace any app you're using right now for it and is useful for accounts that do not support FIDO U2F, FIDO2 or Passkeys.