+ :i7cc sh ^RIt^RIt^RIt^RIHt^RIHt^RIHtH t H t ^RI H t H t HtHtHt^RIHt^RIHtHt^RIHtHt^R IHtHtHtHtHtHtHtH t H!t!H"t"]PF!]$4t%RcR R llt&R R lt'RRlt(Rt)Rt*Rt+]!4R4t,]!4R4t-]!4R4t.]!4R4t/]!4R4t0]!4R4t1]!4R4t2RdRlt3ReRlt4Rt5Rt6]Pn!RRR ].R!7t8]Pn!R"R#R$R%R&]-R!7t9]Pn!R'R(R)R*R+7t:]!] .R,7]Pv]R-444t]Py4]PvR.44t=]Py4]Pv]R/444t>]P4R04t@]@Py4]PvR144tA]@Py4]Pv]P!R24]8]9]:R3444444tC]@PyR44]Pv]P!R24]P!R5]P!R64R7R87]Pn!R9R:R;R<7]8]9]:R=44444444tE]@Py4]Pv]P!R24]P!R>]P!R?4R@R87]RA44444tF]@Py4]Pv]P!R24]Pn!RBRCRD]/R!7]Pn!RERFRG]0R!7]Pn!RHRIR)RJR+7]8]9]:RK444444444tG]@Py4]Pv]P!R24]Pn!RLRMRNR<7]8]9]:RO4444444tH]@Py4]Pv]P!R24]9]RP44444tI]@Py4]Pv]P!R24]Pn!RRRQ].R!7]9]Pn!RRRSRT].R!7RU444444tJ]P4RV4tK]KPyR)RW7]Pv]Pn!R"R$RXR)],RY7]Pn!RRRZR[],R!7]Pn!RHRIR)R\R+7R]44444tL]KPy4]Pv]Pn!R"R#R%R^R)]-RY7]Pn!RRR_R`Ra]-R!7Rb4444tMR#)fiN) serialization) TRANSPORT)SW ApduErrorSmartCardConnection) ALGORITHMCREDENTIAL_PASSWORD_LENMANAGEMENT_KEY_LENHsmAuthSessionInvalidPinError) CAPABILITY)generate_random_management_keyget_hsmauth_info)InvalidPasswordErrorparse_private_key) CliFailclick_callbackclick_force_optionclick_format_option click_groupclick_postpone_execution click_promptget_scp_params log_or_echo pretty_printcs$V^8dQhR\/#)e) Exceptionformat"7/usr/lib/python3.14/site-packages/ykman/_cli/hsmauth.py __annotate__r Bs))I)cs\V\4'd5VPpV'd\RV RV R24h\V R24h\V\4'dVP \ P8Xd \R4hVP \ P8Xd \R4hVP \ P8Xd \R4hVP \ P8Xd \R4hVP \ P8Xd\V R24hM\V\4'dh\V4h) zWrong z, z attempts remaining.z is blocked.z4A credential with the provided label already exists.z:No space left on the YubiKey for YubiHSM Auth credentials.z1Credential with the provided label was not found.zThe device was not touched.z& does not meet complexity requirement.) Z isinstancer Zattempts_remainingrrswrAUTH_METHOD_BLOCKEDZNO_SPACEFILE_NOT_FOUNDZ SECURITY_CONDITION_NOT_SATISFIEDCONDITIONS_NOT_SATISFIED ValueError)rdefault_exception_msgtargetZattempts&&& r handle_errorr*Bs!_%%'' F6("XJ6JKL LVHL12 2 Ay ! ! 442)) )PQ Q TTR[[ VW W TTR&& &MN N TTR88 878 8 TTR00 0VH$JKL L1 Az " " ' ((r!c0V^8dQhR\R\/#)rtouch_requiredreturn)Zboolstrrrrr r Ys$3r!csV'dR#R#)ZOnZOff)r,&r_parse_touch_requiredr1Ys r!cr+)r algorithmr-)rr.rrrr r `s cr!cs4V\P8XdR#R#)Z SymmetricZ Asymmetric)rAES128_YUBICO_AUTHENTICATION)r2r0r_parse_algorithmr4`sI:::r!csj\PV4# \dp\T4hRp?ii;iN)bytesfromhexrr&)hexr& r _parse_hexr:gs0}}S!! ms 2 -2csn\V4p\V4V8wd\RV RV^, R24hV#)zmust be exactly z bytes long (z hexadecimal digits) long)r:lenr&)Zkeykey_lenZkey_type&&&r _parse_keyr>nsG S/C 3x7wi}Wq[MB    Jr!csVP4p\V4V8:dVPVR4#\V4V^,8Xd \V4#\ V R24h)sz must be at most 16 bytes)encoder;Zljustr:r&)Zvaluer<nameZencodedr)r_parse_passwordrAysXllnG 7|w}}We,, 7|w{"%  v67 88r!c$\V\R4#)Management key)r>rctxZparamZvalr=rclick_parse_management_keyrFs c-/? @@r!crB)Management password)rArrDr=rclick_parse_management_passwordrHs 3 24I JJr!crBCredential password)rArrDr=rclick_parse_credential_passwordrKs 3 79N OOr!cL\V\PPR4#)ENC keyr>rr3r<rDr=rclick_parse_enc_keyrO c9AAII9 UUr!crL)MAC keyrNrDr=rclick_parse_mac_keyrRrPr!c\V4#r5r:rDr=rclick_parse_card_cryptorU c?r!crSr5rTrDr=rclick_parse_contextrWrVr!csD\VRRRVR7p\V\R4#)TF)default hide_input show_defaultconfirmation_promptrG)rrAr)promptconfirmZmanagement_password&& r_prompt_management_keyr`s4&#  /1F r!cs@\VRVR7p\V\R4#)TrZr\rJ)rrAr)r]r^credential_passwordr_r_prompt_credential_passwordrcs.&# 46K r!csh\RV 24p\V\PPV4#)zEnter )rr>rr3r<)r@Z symmetric_keyr9r_prompt_symmetric_keyrds2 6$1M y==EEt r!cs\VRV4#)r@)Zgetattr)Zfobjr0r_fnameres 4 &&r!z-cz--credential-passwordzpassword to protect credential)helpcallbackz-mz--management-passwordz--management-keymanagement_keyzthe management passwordz-tz--touchTz-require touch on YubiKey to access credential)Zis_flagrf)Z connectionscsVPR,pVP\4pVPVP4\ V\ PV4p\W#4VPR&V'gAVP\P8Xd"VPR,P4TPR,p\ PTP$9;'d\ PTP&9TPR&R# \d1pTP\P 8Xd \#R4hhRp?ii;i)z% Manage the YubiHSM Auth application Zdevicesessionz.Unable to manage HSMAuth over NFC without SCP.Ninfo fips_unready)objZopen_connectionrZ call_on_closeZcloserr HSMAUTHrZ transportrZNFCZget_management_key_retriesrr"rr%r fips_capable fips_approved)rEZdevZconnZ scp_paramsrrjs& rhsmauthrps  ''( C   2 3Ddjj!Z%7%7>J'9CGGIcmmy}}< GGI  9 9 ; 776?Dd/// 9 9   d&8&8 8GGN  442.. .JK K s8AD$$ E/+EEcs>VPR,p\VPR,4p\PVP9d!\PVP 9VR&\ P!RP\V444R#)z9 Display general status of the YubiHSM Auth application. rjriz FIPS approved N) rlr r rmrnroclickechojoinr)rErjdatas& rrjrjsm 776?D CGGI. /DT... * 2 2d6H6H H_ JJtyyd+,-r!csV'g\P!RRRR7\P!R4VPR,P 4\P!R4\P!R4R#) z Reset all YubiHSM Auth data. This action will wipe all data and restore factory setting for the YubiHSM Auth application on the YubiKey. z\WARNING! This will delete all stored YubiHSM Auth data and restore factory setting. Proceed?TZabortZerrzResetting YubiHSM Auth data...rizHReset complete. All YubiHSM Auth data has been cleared from the YubiKey.z2Your YubiKey now has an empty Management password.N)rrr^rsrlreset)rEforces&&rrwrw s`   (   JJ/0GGI JJR JJCDr!cR#)z Manage YubiHSM Auth credentials.Nr/r/r!r credentialsrz)r!c sVPR,pVP4p\V4^8Xd\P!R4R#\P!R\V4 R24\ RV44p\ ;QJdRV4F 'gK RM RM !RV44'd^ M^ pR p\P!VPR R R R VVR74VFhp\P!VPVP\VP4\VP4VPVVR74Kj R#)zD List all credentials. List all credentials stored on the YubiKey. rizNo items foundzFound z item(s)c3sL"TFp\VP4xK R#5ir5)r;label).0credr9r list..>s?S__s"$c3sZ"TF!qP\P8HxK# R#5ir5)r2rZEC_P256_YUBICO_AUTHENTICATION)r}Zcr9rrrAs!PU1 yFFFPUs)+TFz.{0: <{label_width}} {1: <{type_width}} {2} {3}ZLabelZTypeZTouchZRetries)Z label_widthZ type_widthN)rlZlist_credentialsr;rrrsZmaxZanyrr|r4r2r1r,Zcounter)rEriZcredsZmax_size_labelZ max_size_typeZ format_strr~s& rlistr.s3ggi G  $ $ &E 5zQ #$ VCJLL ., " r!r|csJVPR,'d \R4hVf \4pVf \4pVPR,pVP W1W$4\ P !R4R# \dp\TRR7Rp?R#Rp?ii;i)zGenerate an asymmetric credential. This will generate an asymmetric YubiHSM Auth credential (private key) on the YubiKey.  LABEL label for the YubiHSM Auth credential rkGYubiKey FIPS must be in FIPS approved mode prior to adding credentials.Nriz Asymmetric credential generated.z)Failed to generate asymmetric credential.r') rlrr`rcZgenerate_credential_asymmetricrrrsrr*)rEr|rbrhtouchrirs&&&&& rgenerateras  ww~ U  /1"9;ggi G .. #6   56   %P   s(A?? B" BB"Zimportz private-keyZrbz PRIVATE-KEY)typeZmetavarz-pz --passwordz(password used to decrypt the private key)rfcsbVPR,'d \R4hVf \4pVf \4pVPR,pVP 4pVeVP 4p\ W4pTPTTTTT4\P!R 4R# \dJ\PRRR7Tf\RR RR R 7pKRp\P!R 4Ki;i \dp \T RR7Rp ? R#Rp ? ii;i)zImport an asymmetric credential. This will import a private key as an asymmetric YubiHSM Auth credential to the YubiKey.  LABEL label for the YubiHSM Auth credential PRIVATE-KEY file containing the private key (use '-' to use stdin) rkrNriTzError parsing key)Zexc_infozEnter password to decrypt keyrXF)rYrZr[zWrong password.zAsymmetric credential imported.z'Failed to import asymmetric credential.r)rlrr`rcZreadr?rr loggerZdebugrrrrsZput_credential_asymmetricrr*) rEr|Z private_keyZpasswordrbrhrrirurs &&&&&&& rimport_credentialrs2( ww~ U  /1"9;ggi G    D   (H +D;K  Y))         451$  LL,tL <'3#!&   ,-  2 YQ.WXXYs0: B4+D 45D,DD D. D))D.zpublic-key-outputZwbz PUBLIC-KEYcsVPR,pVPV4pTpVPV\PP R7pVP V4\RV R\V4 2\V4R# \depTP\P8Xd \R4hTP\P8Xd \R4h\R4hRp?ii;i) a2Export the public key corresponding to an asymmetric credential. This will export the long-term public key corresponding to the asymmetric YubiHSM Auth credential stored on the YubiKey.  LABEL label for the YubiHSM Auth credential PUBLIC-KEY file to write the public key to (use '-' to use stdout) ri)ZencodingrzPublic key for z written to z*The entry is not an asymmetric credential.zCredential not found.zUnable to export public key.N)rlZget_public_keyZ public_bytesrZ PublicFormatZSubjectPublicKeyInfoZwriterrerrr"rr#rr$) rEr|Zpublic_key_outputrriZ public_keyZ key_encodingZpublic_key_encodedrs &&&& rexportrs ggi G:++E2  '44! --BB5   23eWL8I1J0K L   : 442)) )FG G TTR&& &12 289 9 :sA/B C5AC00C5z-Ez --enc-keyz the ENC keyz-Mz --mac-keyz the MAC keyz-gz --generatez(generate a random encryption and mac keyc sHVPR,'d \R4hVf \4pVf \4pV'd"V'g V'dVP R4V'd\ P !\PP4p\ P !\PP4p\P!R4\P!RP\RVRV/444V'g \R 4pV'g \R 4pVPR ,pVPVVVVVV4\P!R 4R# \ dp \#T R R7Rp ? R#Rp ? ii;i)zImport a symmetric credential. This will import an encryption and mac key as a symmetric YubiHSM Auth credential on the YubiKey.  LABEL label for the YubiHSM Auth credential rkrNz:--enc-key and --mac-key cannot be combined with --generatezGenerated ENC and MAC keys:rqzENC-KEYzMAC-KEYrMrQrizSymmetric credential stored.&Failed to import symmetric credential.r)rlrr`rcfailosZurandomrr3r<rrrsrtrrdZput_credential_symmetricrr*) rEr|rbrhZenc_keyZmac_keyrrrirs &&&&&&&& r symmetricrs:. ww~ U  /1"9;W MN**YCCKKL**YCCKKL 01 499\9gy'*RSTU ' 2 ' 2ggi G X((          12 XQ.VWWXs,E>> F! FF!z-dz--derivation-passwordz)deriviation password for ENC and MAC keyscspVPR,'d \R4hVf \4pVf \4pVf\ RRRR7pVPR,pVP WAW#V4\ P!R4R# \dp\TR R 7Rp?R#Rp?ii;i) zImport a symmetric credential derived from a password. This will import a symmetric YubiHSM Auth credential by deriving ENC and MAC keys from a password.  LABEL label for the YubiHSM Auth credential rkrNzEnter derivation passwordTrariz$Derived symmetric credential stored.rr) rlrr`rcrZput_credential_derivedrrrsrr*)rEr|Zderivation_passwordrbrhrrirs&&&&&& rderiver:s& ww~ U  /1"9;"* ' $  ggi GX&& #6U   9: XQ.VWWXs')B B5 B00B5cs.Vf \4pV'g\P!RV R2RRR7VPR,pVP W!4\P !R4R# \ dp\TRR 7Rp?R#Rp?ii;i) z Delete a credential. This will delete a YubiHSM Auth credential from the YubiKey.  LABEL a label to match a single credential (as shown in "list") NzDelete credential: z ?TrvrizCredential deleted.zFailed to delete credential.r)r`rrr^rlZdelete_credentialrsrr*)rEr|rhrxrir&&&& rdeleterjs/1  !% + ggi G !!.8 ()   "@   s'A11 B< BBzcurrent credential passwordz-nz--new-credential-passwordz a new credential password to setcsVPR,pV'dV'dVPR4VfVf\P!R4\P!R4\P!R4\ R\P !^^.4^RR 7pV^8Xd \ R 4pM \4pVRJpVf\ R R R 7pV'dVPWV4MVPWV4\P!R4R# \d$p\TRT'dRMRR7Rp?R#Rp?ii;i)a1 Change the password of a credential. This will change the password of a YubiHSM Auth credential stored on the YubiKey. Changing a password requires either the current password for the credential, or the management password (not both).  LABEL a label to match a single credential (as shown in "list") rizA--credential-password and --management-password can't be combinedNzChoose authentication method:z [1] Current credential passwordz [2] Management passwordzEnter selectionF)rrYZ show_choicesz!Enter current credential passwordz!Enter the new credential passwordTr^zCredential password changed.z%Failed to change credential password.rGrJr'r() rlrrrrsrZChoicercr`Z change_credential_password_adminZchange_credential_passwordrr*) rEr|rbrhZnew_credential_passwordriZmethodZuse_management_keyrs &&&&& rchange_passwordrs+>ggi G~ TU"5"= 23 56 -. q!f%   Q;"=3# 45N't3&"= /#    4 4'>   . .,C   12   "I!)&    sD;D E 'EE cry)z&Manage Management Key for YubiHSM AuthNr/r/r!raccessrr{r!)Zhiddenzcurrent management key)rfr[rgz--new-management-keyza new management key to setzJgenerate a random management key (can't be used with --new-management-key)csVf \R4pVPR,pV'dV'dVPR4VfV'd`VPR,PR8d \ R4h\ 4p\ P!RVP4 24M"\P\RR R R 74p\V4\8wd\ R \,4hVPW4\ P!R 4R# \dTPR 4Lri;i \dp\!TRRR7Rp?R#Rp?ii;i) Change the management key. Allows you to change the management key which is required to add and delete YubiHSM Auth credentials stored on the YubiKey. Nz7Enter current management key [blank to use default key]riz?Invalid options: --new-management-key conflicts with --generaterjzDGenerating a random management key is not supported on this YubiKey.zGenerated management key: zEnter the new management keyTraz(New management key has the wrong format.z8Management key has the wrong length (expected %d bytes).zManagement key changed.z Failed to change management key.rCr)ii)r`rlrZversionrr rrrsr8r6r7rrr;rput_management_keyr*)rErhnew_management_keyrrirrrchange_management_keyrsM:/ E ggi Gh RS! wwv&&&0"@!A  JJ34F4J4J4L3MN O E%*]] 6#',0&" "44 F  !   "">F ,- ECD E   "D#   s*0!D%<'E%EE E+E&&E+zcurrent management passwordz--new-management-passwordrz a new management password to setcs Vf \R4pVf\RRR7pVPR,pVPW4\P!R4R# \ dp\ TRR R 7Rp?R#Rp?ii;i) rNz&Enter your current management passwordzEnter a new management passwordTrrizManagement password changed.z%Failed to change management password.rGr)r`rlrrrrsrr*)rErhrrirs&&& rchange_management_passwordr0s2/ 4 !3 -t ggi G "">F 12   "I(   s'A B)A==BrI)zEnter management passwordF)zEnter credential passwordF)NZloggingrrrZcryptography.hazmat.primitivesrZ yubikit.corerZyubikit.core.smartcardrrrZyubikit.hsmauthrrrrr Zyubikit.managementr rpr r Zutilr rrrrrrrrrrrZ getLoggerZ__name__rr*r1r4r:r>rArFrHrKrOrRrUrWr`rcrdreZoptionZ click_credential_password_optionZclick_management_key_optionZclick_touch_optionZ pass_contextZcommandrjrwZgrouprzrZargumentrZFilerrrrrrrrrr/r!rrs8 8"EE*;      8 $).9AAKKPPVVVV  '$)<< ) , $ $ll " , \\)T(W  -./06  . . EE2 ++ ..b ! "  D X EJJt$4mLdL'QR!:Y"SM:Yz #%**T*:LQ":R ":J dKm>QRdKm>QR,+U"4X"SS4Xn  !(S"$X"$XN    @  & ,   + ,  ;   ; | 11t ! '  & '    U  6  *6 r & ,  + ,  " r!