+ :iZ}cs2 ^RIt^RIt^RIHt^RIHt^RIt^RIHt^RI H t ^RI H t ^RI Ht^RIHtHtHt^R IHt^R IHtHtHtHtHtHt^R IHtHtHtH t ^R I!H"t"^R I#H$t$H%t%H&t&H't'H(t(H)t)H*t*H+t+H,t,H-t-H.t.H/t/H0t0H1t1]Pd!]34t4](!].R7]Pj]*R444t]Pm4]PjR44t7]Pm4]Pj]'R444t8]Pr!RRRR7t:]Pr!RRRRR7t;Rt]P4R4t@]@Pm4]Pj]:]Pr!RR RR!R7]Pr!R"R#R$R7];R%444444tA]@Pm4]Pj]:R&444tBR'tC]@Pm4]Pj]Pr!R(R)RRR*]CR+R,7R-444tD]Pr!R.R/RR0R7tE]Pr!R1R2RR3R7tFR4tGR5tHR6tIR7tJR8tKR9tL]P4R:4tM]MPm4]P!R;4]P!R<])R*R=7]Pr!R>R?]%!]4]PPR@RRA7]Pr!RBRC]P!.R~O4RDRERRA7]Pr!R(RF]%!]4]PPRRGRH7]Pr!RRI]P^RJRK7]Pr!RLRMRNR7]Pr!RORPRQ^RRR7]Pr!RSRTRRUR7]Pr!RVRW]P!RX4RYRZ7]Pr!R[R\R7]Pr!R]R^R7]E]']:];]PjR_444444444444444444tU]&!4R`4tV]MPm4]P!Ra]VR*RbRc7]E]']:];]PjRd4444444tW]MPmRe4]P!Rf]P!Rg4RhRi7]E]']:];]PjRj4444444tXRktY]MPmRl4]F]Pj]Pr!R>R?RRmR7]Pr!RORPRRnR7]:];Ro4444444tZ]MPm4]F]Pj]P!RpR*RqRr7]Pr!RsRtRRuR7]:];Rv4444444t[]MPm4]Pj]P!Rp4]P!R;4]Pr!RwRxRRyR7]:];Rz4444444t\]MPm4]Pj]P!Rp4]Pr!RwRxRR{R7]:];R|444444t]R#)N) b32encode)Any)NameOID)PSKC)parse_rfc4514_string) TRANSPORT)SW ApduErrorSmartCardConnection) CAPABILITY)HASH_ALGORITHM OATH_TYPECredentialData OathSession_format_cred_id parse_b32_key)calculate_steamdelete_broken_credential is_hiddenis_steam)AppData)CliFail EnumChoiceclick_callbackclick_force_option click_groupclick_parse_b32_keyclick_postpone_execution click_promptget_scp_params is_yk4_fips log_or_echo pretty_printprompt_for_touchprompt_timeout)Z connectionscspVPR,pVP\4pVPVP4\ V\ PV4p\W#4VPR&\R4VPR&VPR,p\ PVP9pT;'d\ PVP9VPR&T;'d-VP\P8H;'dV'*VPR&R#)ac Manage the OATH application. Examples:  Generate codes for accounts starting with 'yubi': $ ykman oath accounts code yubi  Add an account with the secret key f5up4ub3dw and the name yubico, which requires touch: $ ykman oath accounts add yubico f5up4ub3dw --touch  Set a password for the OATH application: $ ykman oath access change Zdevicesession oath_keysinfo fips_unreadyno_scpN)objZopen_connectionr Z call_on_closeZcloserr OATHrr fips_capable fips_approvedZ transportrZNFC)ctxZdevZconnZ scp_paramsr&Zis_fips& 4/usr/lib/python3.14/site-packages/ykman/_cli/oath.pyoathr0Hs. ''( C   2 3Ddjj!Z__d;J$T6CGGI";/CGGK 776?Doo!2!22G%SS*//ASAS*SCGGNUUCMMY]]$BUU:~CGGHcs^VPR,pVPR,pRRVP,/pV.p\PVP9d"\PVP 9VR&M \ V4'dVPVR&VP'dRMRVR&VPR ,pVP'd#VPV9dVPR 4\P!R P\V444R #) z1 Display general status of the OATH application. r$r&z OATH versionz%d.%d.%dz FIPS approvedZenabledZdisabledzPassword protectionr%z5The password for this YubiKey is remembered by ykman.Z N)r)versionr r*r+r,rlocked device_idappendclickechoZjoinr!)r-r$r&dataZlineskeysr.r/r&r&ms ggi G 776?D*J,HIDvE$+++ *43E3E E_ T   '_/6~~~):D  77; D~~~'++t3 LM JJtyye,-.r1cs~V'g\P!RRRR7VPR,p\P!R4VPpVP 4VPR,pW49d(WCVP 4\PR4\P!R4R #) z Reset all OATH data. This action will delete all accounts and restore factory settings for the OATH application on the YubiKey. zYWARNING! This will delete all stored OATH accounts and restore factory settings. Proceed?TZaborterrr$zResetting OATH data...r%Deleted remembered access keyzEReset complete. All OATH accounts have been deleted from the YubiKey.N) r6confirmr)r7r4resetwriteloggerr&)r-forcer$Zold_idr9s&& r/r>r>s   !  ggi G JJ'(   F MMO 77; D ~ L  34 JJVWr1z-pz --passwordz"the password to unlock the YubiKey)helpz-rz --rememberTz%remember the password on this machine)is_flagrBcsRVPR,pVPR,pVPV4V'dhVPVPVP 44VP 4\ PR4\P!R4R#R#)r$r%zAccess key rememberedPassword remembered.N) r)Zvalidate put_secretr4hexr?r@r&r6r7)r-keyrememberr$r9s&&& r/ _validaterIsqggi G 77; D S ))37795  +, )* r1csfVPR,pVPR,pVPpVP'dV'd5\P R4VP V4p\ WV4R#We9dI\P R4\PVPV44p\ WR4R#\#VR R 7pVP V4p\ WV4R#V'd \%R 4hR# \dQpTP\P8Xd(\P R4YVTP4Rp?LRp?i\d"p\P!RTR7Rp?LRp?ii;i \d \%R 4hi;i) r$r%z,Access key required, using provided passwordNz)Access key required, using remembered keyFz&Remembered key incorrect, deleting keyzError authenticating)Zexc_infoT hide_input5Authentication to the YubiKey failed. Wrong password?z*Password provided, but no password is set.)r)r4r3r@debug derive_keyrIbytesfromhexZ get_secretrswrZINCORRECT_PARAMETERSr? Exceptionwarningrr) r-passwordrHpromptr$r9r4rGes &&&& r/ _init_sessionrWs_ggi G 77; D!!I~~~ S KL((2#H-  HI G-- (BCCc.$Ft>>  &&' JJL KK7 8 <=   " #$8TJH  * S c % JJ- . T   SQR R SsC0 "D 0D D!csV'dVP'dR#\R4pV'd!VP4VP4\P !R4VP 4R#)Nr%z"All passwords have been forgotten.)Zresilient_parsingrrar?r6r7exit)r-paramvaluer9s&&& r/_clear_all_passwordsrgZsH C))) ; D    JJ34HHJr1z-az--allFzremove all stored passwords)rCZis_eagerZ expose_valuecallbackrBcs4VPR,pVPpVPR,pW#9dJW1PVP4\P R4\ P !R4R#\ P !R4R#)z. Remove a stored password from this computer. r$r%r<zPassword forgotten.z$No password stored for this YubiKey.N)r)r4r?r@r&r6r7)r-r$r4r9s& r/forgetrifsmggi G!!I 77; D "" #  34 () 9:r1z-tz--touchz)require touch on YubiKey to generate codez-Hz --show-hiddenzinclude hidden accountscs8VPPR4#)zutf-8)iddecode)Z credential&r/ _string_idrms ==   ((r1cs\P!RRR7\P!RRR7VF$p\P!\V4RR7K& VP^4R#)z6Error: Multiple matches, make the query more specific.T)r;N)r6r7rmrd)r-hitscreds&& r/_error_multiple_hitsrqsG JJGTR JJrt :d#.HHQKr1cs.pVFjp\V4pV'g\V4'dK)WQ8XdV.u#VP4VP49gKYVPV4Kl V#N)rmrlowerr5)credsquery show_hiddenroccred_ids&&& r/_searchrys[ D Q-y||   3J ;;=GMMO + KKN Kr1csT\V4P4PRR4#)Z=rn)rrkZreplacerGrlr/ _b32_encoder{s" S> " * *3 33r1cs\VRV4#)name)Zgetattr)Zfobjrlr/_fnamer}s 4 &&r1z$urn:ietf:params:xml:ns:keyprov:pskc:crY)zManage and use OATH accounts.NrZrZr1r/accountsr~r\r1r|secret)rhrequiredz-oz --oath-typez1time-based (TOTP) or counter-based (HOTP) account)typedefaultrB show_defaultz-dz--digits6z"number of digits in generated codez --algorithmz$algorithm to use for code generation)rrrrBz --counterz'initial counter value for HOTP accounts)rrrBz-iz--issuerz issuer of the account (optional)z-Pz--periodz&number of seconds a TOTP code is valid)rBrrz-gz --generatez=generate a random credential key (cannot be used with SECRET)z-Oz--outputZwbzKwrite the credential to a PSKC file in addition to adding it to the YubiKey)rrBz --pskc-keyz1encrypt the PSKC file with a pre-shared key (hex)z--pskc-passphrasez'encrypt the PSKC file with a passphrasecsVPR,'d \R4h\V4pVPR,PpV'dVf \R4hV'd*V'd \R4h\P !^4pV'dV'd \R4hV'g V'dV'g \R4hV'd2VR 8Xd\ R R R R 7p\V4^8d \R 4hMNV'dGVR 8Xd\ RR R R 7p\PV4p\V4^8wd \R4hV'g\ R4p\V4p\W V4\!W'WWW4p\#VVV V 4\%R\&V4V'Ed\)4pV'd2VP*P-V4\&P/R4M9V'd2VP*P1VR7\&P/R4VP2pVP4'dVP4R,V,p\7VP8\: VP<P2P?4 2VVRVP4RVP2 2V\AVPB4RVPDP2R7 pVP<\FPH8Xd\AVPJ4VR&M\AVPL4VR&VPN!R/VBVPQV4\%R\SV4 2\&V4R#V'd%\P!R\UV4 24R#R# \dRpELi;i \d#p\P!T4Rp?EKRp?ii;i) z Add a new account. This will add a new OATH account to the YubiKey.  NAME human readable name of the account, such as a username or e-mail address SECRET base32-encoded secret/key value provided by the server r'zDYubiKey FIPS must be in FIPS approved mode prior to adding accounts.r&Nz>YubiKey has readable serial number, cannot write to PSKC file.z6Cannot use --generate together with a provided SECRET.z1Cannot use both --pskc-key and --pskc-passphrase.zAMust specify --output when using --pskc-key or --pskc-passphrase.Z-z%Enter passphrase to encrypt PSKC fileTr^z)Passphrase must be at least 8 characters.z/Enter pre-shared key (hex) to encrypt PSKC filer1z4Pre-shared key must be 16 bytes (32 hex characters).zEnter a secret key (base32)zOATH account addedz+PSKC file will be encrypted with passphraserzz/PSKC file will be encrypted with pre-shared key:ZYubicozCN=ZDECIMAL) r algorithmrjserialZ manufacturerissuer key_userid friendly_nameresponse_lengthZresponse_encodingalgorithm_suite time_intervalcounterz!Credential written to PSKC file: z&Generated credential secret (base32): rZ)+r)rZintrosZurandomrlenrOrPr`rrRr6r7rWr _add_credr r@r encryptionZ setup_pbkdf2rMZsetup_preshared_keyr|rZdictr_PSKC_ALG_PREFIX oath_typersstrdigitshash_algorithmr TOTPperiodrZadd_keyr?r}r{)r-rr|rrZgenerateZoutputrrtouchrrrArTrHZpskc_keyZpskc_passphraserrVrppskcrZfieldss&&&&&&&&&&&&&&&&& r/addrs=@ ww~ R  [F WWV_ # #F &.VWW RS SBOIJJOV O   c !*7$(O  ! #EF F $  s?#A$(H  }}X.H x=B PQ Q !"?@F &v.#*  FG D     $ff5 vv  OO ( ( 9 LLF G  OO / /H / = LLJ K ;;; KK#- =M;;)*4>>+>+>+D+D+F*GH!;;TYYK(' ,' //44   >>Y^^ +&)$++&6F? # #DLL 1F9  v 6/v/? @&&   ;KSVV^ LL? @ """ 3..446 7$$  SVV    (9(9!9,,223:LFD :::ZZF >>> &)#..9001D1DEaHNN!$,,,,)&&++!$$**KK$$1  +1&3,b9$@ U]]%5l^2#FPTUU c4 . JJ7 8 aKFor  fX456ABBG TRSS T" R  6 + &~~ &s7$N* OAO#*O O  OO #PPcsHa VPR,pVPp^\VP4u;8d^@8:gM\ R4h\VP 4^8d \ R4hV'dVR8g \ R4hVP 'd+VP\P8wd \ R4hVP\P8Xd5VR8d#\VPR,4'd \ R4hVP4pVP4o V'gh\ ;QJdV 3RlV4F 'gK RM R M!V 3RlV44'd(\"P$!R VP R 2RRR 7RTu;8;'dR8Mup\ ;QJdV 3R lV4F 'gK RM R M!V 3R lV44pV'dV'd \ R4hVP'W4R# \(dkp T P*\,P.8Xd \ R4hT P*\,P08Xd \ R4h\3Y 4Rp ? R#Rp ? ii;i)r$z$Name must be between 1 and 64 bytes.z Secret must be at least 2 bytes.z/Require touch is not supported on this YubiKey.z)Counter only supported for HOTP accounts.r&z/Algorithm SHA512 not supported on this YubiKey.c3@<"TFqPS8HxK R#5irrrj.0rprx& r/ _add_cred..)s>G+TFzAn account called z= already exists on this YubiKey. Do you want to overwrite it?r:c3s<"TF6qPPS4;'dVPS8gxK8 R#5irr)rjrrrr/rr2s5IN  G $ ; ;G); ;s %AAz:Choose a name that is not a subset of an existing account.z/No space left on the YubiKey for OATH accounts.z9The command failed. Is there enough space on the YubiKey?N)ii)ri)rrr)rri)r)r2rr|rrrrr HOTPrr ZSHA512rlist_credentialsZget_idanyr6r=Zput_credentialrrQrZNO_SPACEZCOMMAND_ABORTEDrX) r-r8rrAr$r2rtZfirmware_overwrite_issueZcred_is_subsetrVrxs &&&& @r/rrsggi GooG DII $" $<== 4;;!899 W )GHH |||)..8ABB n333 y K$@$@GHH  $ $ &EkkmG SS>>SSS>>>>   ,, ,   )7>>Y>SINSSSINN  NRSSt+  442;; KL L TTR'' 'UV V# sH,, J!7AJJ!Zlistzdisplay the OATH typezdisplay the periodcs(\WV4VPR,pVP4Uu.uF pV'g\V4'dKVNK" ppVP 4VFp\ P !\V4RR7V'd0\ P !RVPP 2RR7V'd&\ P !RVP 2RR7\ P !4K R#uupi)z> List all accounts. List all accounts stored on the YubiKey. r$F)Znlz, N) rWr)rrZsortr6r7rmrr|r) r-rvrrrTrHr$rprts &&&&&& r/ list_credsrEs#*ggi G,,. .D io .    JJL :d#.  JJDNN//01e <  JJDKK=)e 4   s DDDrurn)rrz-sz--singlez4ensure only a single match, and output only the codecs"\WV4VPR,pVP4p\TP4Y!4p \T 4^8XEdT ^,p T P'd \4\!T 4'd \#Yj4p MYz,'dYz,P$p MrT P&\(P*8Xd8\-4;_uu_4TP/T 4P$p RRR4MTP/T 4P$p T'd\4P6!X 4R#\4P6!\9T 4 RX 24R#T'd!T 'd\;Y 4R#\3R4h.p \=T 4Fp Yz,p T 'd+\!T 4'd \#Yj4pMFT P$pM9T P'dRpM$T P&\(P*8XdR pMR pT P?\9T 4T34K T 'd\AR T 44M^pT 'd\AR T 44M^pR TT3,pT F,wpp\4P6!TPCTT44K. R# \dxpTP\ P 8XdS\PR4\T4'dTP4pRp?EL\PR4hhRp?ii;i +'giEL;i \d1pTP\ P08Xd \3R4hhRp?ii;i)z Generate codes. Generate codes from OATH accounts stored on the YubiKey. Provide a query string to match one or more specific accounts. Accounts of type HOTP, or those that require touch, require a single match to be triggered. r$z2Corrupted data in OATH accounts, attempting to fixzUnable to fix memory failureNzTouch account timed out!z zNo matching account found.z[Requires Touch]z[HOTP Account]rnc3s<"TFwr\V4xK R#5irrrrZnrw& r/rcode..8fq3q66c3s<"TFwr\V4xK R#5irrrrrr/rrrrz{:<%d} {:>%d})"rWr)Z calculate_allrrQrZMEMORY_FAILUREr@rSrZerrorryr9rZtouch_requiredr"rrrfrr rr#Zcalculate_codeZ SECURITY_CONDITION_NOT_SATISFIEDrr6r7rmrqZsortedr5ZmaxZformat)r-rvruZsinglerTrHr$ZentriesrVrtrprfZoutputscodeZcodestrZ longest_nameZ longest_codeZ format_strr|Zresultrr/rrcs,#*ggi G '') GLLNE 7E 5zQQx       ~~'6 ++>>Y^^3'))!( 6 6t < B B*) $2248>>E  JJu  JJ*T*+2eW5 6    ,67 75MD=DD>>-g>1* NNJt,g6 7"=Ds888 :" to specify issuer) r$TNo matches, nothing to be done.rNc3rrrr)rrpnew_idrr/rZrename..s3UTww& UrFzAnother account with ID z already exists on this YubiKey.zRename account: rrr;zRenamed z to .zRename aborted by user.)rWr)rryrr6r7rrrrrrrkr=rmZrename_credentialrjrq) r-rur|rArTrHr$rtrorprrs &&&&&& @r/renamersb #*ggi G  $ $ &E 5 &D 4yA~ 45 TaAw $;::c1-LFDF t~~t{{K 33U33333U3 3 3*6==?*;<22   MM":d#3"4B7    % %dggt < JJ*T"2!34 7HJ K JJ0 1 S'r1z"confirm deletion without promptingcs,\WV4VPR,pVP4p\WaR4p\ V4^8Xd\ P !R4R #\ V4^8XdV^,pV'g-\ P!R\V4 R2RRR7'dAVPVP4\ P !R\V4 R 24R #\ P !R 4R #\W4R #) zz Delete an account. Delete an account from the YubiKey.  QUERY a query to match a single account (as shown in "list") r$TrzDelete account: rFrzDeleted rzDeletion aborted by user.N) rWr)rryrr6r7r=rmZdelete_credentialrjrq) r-rurArTrHr$rtrorps &&&&& r/deleters #*ggi G  $ $ &E 5 &D 4yA~ 45 TaAw  MM":d#3"4B7    % %dgg . JJ*T"2!315 6 JJ2 3 S'r1)rc)rZ7Z8)^ZloggingrZbase64rZtypingrr6Zcryptography.x509rrrZ ykman.pivrZ yubikit.corerZyubikit.core.smartcardrrr Zyubikit.managementr Z yubikit.oathr r r rrrr0rrrrZsettingsrZutilrrrrrrrrrrr r!r"r#Z getLoggerZ__name__r@Z pass_contextZcommandr&r>ZoptionZclick_password_optionZclick_remember_optionrIrWrXZgroupr[rbrHrgriZclick_touch_optionZclick_show_hidden_optionrmrqryr{r}rr~Zargumentrr|ZChoicerZINTZFilerrrrrrrrrrZr1r/rsk8  %*"EE)RQ"   8 $ -./V0VD//.XX< ,A    0 +'DT //  &  d$+RS5T 5pSS@    ! &;;"\\)T(S!<</4.G ) 4':(( #6G I  NN   <  o &  -  N #    $ $ /   2 dJ%GH 1    H   D  V   < 2DS    IHFDSNHH 5%P&Q&> ( EJJt$4fE\CF\C~0f &dM46MNdJ3GHIO. %4  ?  Q8 5Q8h dIt2TU)(V)(X dIt2VW(X (r1