+ :imncs ^RIt^RIt^RIt^RIHt^RIHt^RIHt^RIt^RI H t H t ^RI H t HtHtHt^RIHt^RIHt^R IHtHtHtHtHtHtHtHt^R IHtH t H!t!H"t"H#t#H$t$H%t%^R I&H't'H(t(^R I)H*t*H+t+H,t,H-t-H.t.H/t/H0t0H1t1H2t2H3t3H4t4]Pj!]64t7R t8Rt9]Pt!R]Pv!RR.4RR7t<]Pz!RRRRR7t>Rt?Rt@RtA].!]].R7]P]0]Pz!RRRRR 7R!4444tRR"ltC]P4]PR#44tE]P4]-]PR$444tF]P4]<]P]Pz!R%R&R'R(7]Pz!R)R*]+!]4R+RR,R-7R.44444tG]P4]<]-]PR/4444tH]P4]<]Pz!R0R1RR2R3R47]Pz!R%R5RR]8!^4R6R77]Pz!R8R9RR]8!^4R:R77]>]Pz!R;R7]Pz!R?R@RRRAR>7]Pz!RBRCRRRDR>7]Pz!RERFRRRRG7]Pz!RHRI]P!RJ4RRKRL7]-]PRM4444444444444tJ]P4]<]Pt!RNRRO7]Pz!R?RPRRQRR7]Pz!RSRTRU]P!^^&4^&RRVRW7]Pz!R8RX]+!]'4R3RRYR-7]>]-]PRZ444444444tL]P4]<]Pt!R[RRO7]Pz!R)R\RR]RR7]Pz!R^R_RRR`R>7]Pz!R?RPRRRaR>7]-]PRb44444444tM]P4]<]Pt!RcRRO7]Pz!R^R_RRdRR7]Pz!ReRf]Pv!RgRh.4RgRRiR-7]PRj444444tNRktO]P4]<]Pt!R[]/RRl7]Pz!ReRf]Pv!RgRh.4RgRRmR-7]Pz!RnRo]P^RpRq7]Pz!RrRsRtR(7]>]-]PRu444444444tQ]P4]<]-]P]Pz!RvRwRRRxRy7]Pz!RzRR{RR7]>]Pz!R%R|]Pv!.RO4R}RR~R-7]Pz!RRRRR7]Pz!RRRRR7R4444444444tRR#)iN) b32encode)Event)time) TRANSPORT CommandError)MODHEX_ALPHABET OtpConnection modhex_decode modhex_encode)SmartCardConnection) CAPABILITY) NDEF_TYPESLOTHmacSha1SlotConfigurationHotpSlotConfigurationStaticPasswordSlotConfigurationUpdateConfigurationYubiOtpSessionYubiOtpSlotConfiguration) format_csvformat_oath_codegenerate_static_pwis_in_fips_mode parse_b32_keyparse_oath_keytime_challenge)KEYBOARD_LAYOUTencode) CliFail EnumChoiceclick_callbackclick_force_option click_groupclick_parse_b32_keyclick_postpone_execution click_prompt is_yk4_fips log_or_echoprompt_for_touchcs.a\4V3Rl4pV#)csp<\PV4p\V4S8wd\RS R24hV#)zMust be exactly z bytes.)bytesfromhexlen ValueError)ctxZparamZvallengths&&&3/usr/lib/python3.14/site-packages/ykman/_cli/otp.pyinnerZparse_hex..innerUs7mmC  s8v /xw?@ @ )r)r,r.sf r- parse_hexr0Ts Lr/cs\PV4p\ T4^8wd \R4hT# \dp\T4hRp?ii;i)NzMust be exactly 6 bytes.)r'r(Z TypeErrorr*r))Zaccess_code_hex access_codees& r-parse_access_code_hexr3_sRmmO4  ;1344  ms4 A A  AslotZ1Z2cs*\\V44#N)r int)ZcZpZvs&&&r-r7ks DQLr/)typecallbackz--enter/--no-enterTz)send an Enter keystroke after slot output)default show_defaulthelpz|Failed to write to the YubiKey. Make sure the device does not have restricted access (see "ykman otp --help" for more info).csrVPV4'd \P!RV R2RRR7R#R#)Slot z0 is already configured. Overwrite configuration?TZabortZerrN) is_configuredclickconfirm)Z slot_stater4s&&r-_confirm_slot_overwriterB|s7%% D6I J &r/cs\VRV4#)Zname)Zgetattr)Zfobj&r-_fnamerDs 4 &&r/)Z connectionsz --access-codeFZHEXz;6 byte access code (use "-" as a value to prompt for input))requiredmetavarr<csVe!VR8Xd\RRR7p\V4pWPR&R# \dp\RT 24hRp?ii;i)al Manage the YubiOTP application. The YubiKey provides two keyboard-based slots which can each be configured with a credential. Several credential types are supported. A slot configuration may be write-protected with an access code. This prevents the configuration to be overwritten without the access code provided. Mode switching the YubiKey is not possible when a slot is configured with an access code. To provide an access code to commands which require it, use the --access-code option. Note that this option must be given directly after the "otp" command, before any sub-command. Examples:  Swap the configurations between the two slots: $ ykman otp swap  Program a random challenge-response credential to slot 2: $ ykman otp chalresp --generate 2  Program a Yubico OTP credential to slot 1, using the serial as public id: $ ykman otp yubiotp 1 --serial-public-id  Program a random 38 characters long static password to slot 2: $ ykman otp static --generate 2 --length 38  Remove a currently set access code from slot 2): $ ykman otp --access-code 0123456789ab settings 2 --delete-access-code N-zEnter the access codeT) hide_inputFailed to parse access code: r1)r#r3 Exceptionrobj)r+r1r2&& r-otprMsg\  # &'>4PK ?/  > ?s 6 AAAcsVPR,pVPR,pV'g+VPR8d\\.pM \\.pVPP R4pV'd\V9d \.pM \ R4hVFgpVP V4'gKVPV4pVPVP4V'd V!V4pMRp\Wg4u# \ R4h \d"p\PRT4Rp?KRp?ii;i)deviceinfoZscpz-SCP can only be used with SmartCardConnectionNzFailed to open connection: %szVThe connection type required for this command is not supported/enabled on the YubiKey.)ii)rKZversionr rZgetrZsupports_connectionZopen_connectionZ call_on_closeZcloserrJloggerwarning) r+ZtypesdevrOZ resolve_scpZ conn_typeZconnZ scp_paramsr2s && r- _get_sessionrTs  ''( C 776?D  <<9 $(-8E"$78E''++e$K % '()EIJ J  " "9 - - **95!!$**-!,T!2J!%J%d77     >B s93D-D D>D99D>cs \V4pVP4pVP\P4pVP\P 4p\ P!RT;'d R;'gR 24\ P!RT;'d R;'gR 24\VPR,4'd/\ P!R\V4'dRMR 24R #R #) z2 Display general status of the YubiKey OTP slots. zSlot 1: Z programmedZemptyzSlot 2: rOzFIPS Approved Mode: ZYesZNoN) rTget_config_stater?r ZONEZTWOr@echor$rKr)r+sessionstateZslot1Zslot2s& r-rOrOs 3G  $ $ &E    )E    )E JJ%00L;;G<=> JJ%00L;;G<=>3776?## )?73K3K%QU)VWX$r/cs\V4pV'g\P!RRRR7VP4\P!R4R# \ d\ \4hi;i)z$ Swaps the two slot configurations. z"Swap the two slots of the YubiKey?Tr>zSlots swapped.N)rTr@rAZ swap_slotsrVrr_WRITE_FAIL_MSG)r+forcerWrLr-swapr[s^3G  0 ' #$ 'o&&'s &AA1z-pz--prefixz.added before the NDEF payload, typically a URI)r<z-tz --ndef-typeZURIzNDEF payload type)r8r:r;r<csfVPR,p\V4pVP4pVP\P 4'g \ R4hVPV4'g\ RV R24hVPWVPR,V4\PVPP\P ,9d\PR4\P !R4R# \"d\ \$4hi;i) z Configure a slot to be used over NDEF (NFC).  If "--prefix" is not specified, a default value will be used, based on the type: - For URI the default value is: "https://my.yubico.com/yk/#" - For TEXT the default is an empty string rOz"This YubiKey does not support NFC.r=z is empty.r1zBNDEF is currently disabled. Enable using 'ykman config nfc -e otp'zNDEF configuration updated.N)rKrTrUZ has_transportrNFCrr?Zset_ndef_configurationr ZOTPZconfigZenabled_capabilitiesrQrRr@rVrrY)r+r4ZprefixZ ndef_typerOrWrXs&&&& r-ndefr]s* 776?D3G  $ $ &E   imm , ,:;;   t $ $dV:.// '&&tSWW]5KYW >>!A!A)--!P P NNT   01 'o&&'s B DD0cs\V4pVP4pV'g#VPV4'g \R4hV'g\P !RV R2RRR7VP WPR,4\P!RV R24R # \d\\4hi;i) z- Deletes the configuration stored in a slot. z%Not possible to delete an empty slot.z7Do you really want to delete the configuration of slot ?Tr>r1zConfiguration slot z deleted.N) rTrUr?rr@rAZ delete_slotrKrVrrY)r+r4rZrWrXs&&& r-deleter_Fs3G  $ $ &E ,,T22=>>  EdV1 M 'D''-"89 (i89 'o&&'s ,generate a random private ID (can't be used with --private-id)z-Gz--generate-keyz7generate a random secret key (can't be used with --key)z-uz--upload)r`rEZhiddenz-Oz--config-outputZazGfile to output the configuration to (existing file will be appended to))r8rEr<c s\V4p Rp V 'd \R4hV'dV'd \R4hV'dV'd \R4hV'dV 'd \R4hV'gyV'dSV P4p \ R\ P !RT 4,4p\P!R T 24MV'd \R 4h\R 4p\V4^,'d \R 4h\V4pT'gzT'd?\P!^4p\P!RTP!4 24M3T'd \R4h\R4p\"P%T4pT'gzT 'd?\P!^4p\P!RTP!4 24M3T'd \R4h\R4p\"P%T4pT'g\P&!RT R2RRR7TP(R,pT P+T\-YT4P/T4TT4T 'd_T ;'gT P4p \3YY4T4pT P5TR,4\7R\9T 4 2\:T 4R#R# \d \R4hi;i \d\R \ R24hi;i \d\\04hi;i)z" Program a Yubico OTP credential. NzAutomated YubiCloud upload support has been ended. You can manually upload a credential by saving it as a CSV file (use -O/--config-output) and then submitting it to https://upload.yubico.com.z?Invalid options: --public-id conflicts with --serial-public-id.zBInvalid options: --private-id conflicts with --generate-public-id.z5Invalid options: --key conflicts with --generate-key.z2Serial number not set, public ID must be provided.ss>Iz#Using YubiKey serial as public ID: zgPublic ID not given. Remove the --force flag, or add the --serial-public-id flag or --public-id option.zEnter public IDz2Invalid public ID, length must be a multiple of 2.z#Invalid public ID, must be modhex (z).z'Using a randomly generated private ID: zlPrivate ID not given. Remove the --force flag, or add the --generate-private-id flag or --private-id option.zEnter private IDz'Using a randomly generated secret key: z^Secret key not given. Remove the --force flag, or add the --generate-key flag or --key option.zEnter secret keyz%Program a YubiOTP credential in slot r^Tr>r1Z z$Configuration parameters written to )rTr get_serialrrstructZpackr@rVr#r)rr*rosurandomhexr'r(rArKput_configurationr append_crrYrZwriter%rDrQ)r+r4Z public_idZ private_idkeyenterrZZserial_public_idZgenerate_private_idZ generate_keyZuploadZ config_outputrWZserialZpublic_id_bytesr1Zcsvs&&&&&&&&&&&& r-yubiotprj_sb3G F  )  %WXX) P   |MNN   T ++-&kFKKv4N&NOI JJ2J  8 8 :DA '!!  +J 7 A A% H GGM " GGM "   4TF!<= 'o&&'s /A(DD4rhz--touchz3require touch on the YubiKey to generate a responsez-Tz--totpzAuse a base32 encoded key (optionally padded) for TOTP credentialsz>generate a random secret key (can't be used with KEY argument)cs\V4pV'd4V'd \R4hV'd \V4pM\V4pMV'dV'g \R4hV'dz\P !^4pV'd4\ V4P4p\P!RV 24M_\P!RVP4 24M7V'd\R4p\V4pM\R4p\V4pV'dR MR p V'g!\P!R V R V R 2RRR7VPV\V4P!V4VP"R,VP"R,4\P!V RV R24R# \d"p \P!T 4Rp ? KRp ? ii;i \$d\\&4hi;i)z Program a challenge-response credential. If KEY is not given, an interactive prompt will ask for it.  KEY a key given in hex (or base32, if --totp is specified) z8Invalid options: --generate conflicts with KEY argument.z^No secret key given. Remove the --force flag, set the KEY argument or set the --generate flag.z)Using a randomly generated key (base32): z&Using a randomly generated key (hex): TEnter a secret key (base32)NzEnter a secret keyZTOTPzchallenge-responsez Program a z credential in slot r^r>r1z credential stored in slot rl)rTrrrrcrdrZdecoder@rVrer#rJrArfr Z require_touchrKrrY) r+r4rhtotpZtouchrZrmrWZb32keyr2Z cred_types &&&&&&& r-chalresprqRsD3G TU U $C %C C **R.C"3..0 FvhOP CCGGI;OP "#@A"',C34C %C$8I   #7vQ ? '!!  %c * 8 8 ? GGM " GGM "   i[ ;D6CD)!"JJqMM"* 'o&&'s%8 F;A*G*; G'G""G'*H challengezBgenerate a TOTP code, use the current time if challenge is omittedz-dz--digitsZ6Z8zEnumber of digits in generated TOTP code, ignored unless --totp is setcsZa VPR,pVP\P8Xd\ V\ .4pM\ V\ .4pV'gV'g \R4pVP4PV4'g \R4hV'd8Vf\\\444pM+\\V44pM\"P%V4p\'4pV 3Rlo VP)WVS 4pV'd\+V\V44p MVP-4p \.P0!V 4R# \d"\P!R4\R4hi;i \2d\\44hi;i)z Perform a challenge-response operation. Send a challenge (in hex) to a YubiKey slot with a challenge-response credential, and read the response. Supports output as a OATH-TOTP code. rNzEnter a challenge (hex)z3Cannot perform challenge-response on an empty slot.NzError parsing challengez0Timestamp challenge for TOTP must be an integer.csp<\SR4'g#V^8Xd\4\SRR4R#R#R#)ZpromptedTN)Zhasattrr&Zsetattr)Zstatus on_keepalives&r-rsZcalculate..on_keepalives1<441 " j$7:E4r/)rKZ transportrr\rTr rr#rUr?rrr6rrJrQZ exceptionr'r(rZcalculate_hmac_sha1rrer@rVrrY) r+r4rrrpdigitsrSrWZeventZresponsevaluerss &&&&& @r- calculatervsR2 ''( C }} %s%8$9:s]O4 T !:;   # # % 3 3D 9 9KLL  &s46{3I R*3y>: MM), ' 8 ..t|T $Xs6{;ELLNE 5) R  !:;PQQ R* 'o&&'s E 7A'F ,F F*csR\V43# \dA\T4R\P T43u# \d \R4hi;ii;i)TFzvalue must be modhex or decimal)rr*r6r'r()rurCr-parse_modhex_or_bcdrwsg@]5))) @ @ J%--.. . @>? ? @ @s  A!?AAA)r9rEz"number of digits in generated codez-cz --counterzinitial counter value)r8r:r<z-iz --identifierztoken identifiercs\V4pRp Rp V'EdVR8XdRp\V4^8XdWXP4R , pM\V4^8Xd RV,p\V4^ 8wd \R4h\ VR,4wr\ VR,4wr\ VR,4wppV 'dV 'g \R 4hV'dV 'd V 'g \R 4hW,V,pV'dR ;rMV 'dR p M V 'dR p MR pV'g\ R 4p\ V4pV'g\P!RV R2R R R7VPV\V4PV4PVW4P\!V4^8H4P#V4VP$R,VP$R,4\P!RV R24R# \d#p\P!T4Rp?EK Rp?ii;i \&d\)\*4hi;i)a Program an HMAC-SHA1 OATH-HOTP credential. The YubiKey can be configured to output an OATH Token Identifier as a prefix to the OTP itself, which consists of OMP+TT+MUI. Using the "--identifier" option, you may specify the OMP+TT as 4 characters, the MUI as 8 characters, or the full OMP+TT+MUI as 12 characters. If omitted, a default value of "ubhe" will be used for OMP+TT, and the YubiKey serial number will be used as MUI. FrGZubheZ08z&Incorrect length for token identifier.:NN:rxrPN:rPNNz0TT can only be modhex encoded if OMP is as well.z9MUI can only be modhex encoded if OMP and TT are as well.Tr/roNz"Program a HOTP credential in slot r^r>r1zHOTP credential stored in slot rl)rTr)rar*rwr#rrJr@rVrArfrZimftoken_idZdigits8r6rgrKrrrY)r+r4rhrtZcounterZ identifierrirZrWZmh1Zmh2Zomp_mZompZtt_mZttZmui_mZmuiryr2s&&&&&&&& r-hotprzs43G C Cz  J z?a  //1"5 6J _ !*,J z?b EF F(B8 &z#7(B8 s OP P %DK 8c>  C# C C <=C #C(  0a 8$  '!!  !# & S\ Xh ) WS[A% & Yu  GGM " GGM "   4TF!<=%  1  & 'o&&'s% H4B"I I#III#z-Az--new-access-codezHa new 6 byte access code to set (use "-" as a value to prompt for input))rFrEr<z--delete-access-codez remove access code from the slotz--pacing0zJthrottle output speed by adding a delay (in ms) between characters emittedz--use-numeric-keypadzVuse scancodes for numeric keypad when sending digits (helps for some keyboard layouts)z--serial-usb-visiblez4make the serial number visible in the USB descriptorc s\V4p V'dV'd \R4hV'd%VPR,'g \R4hV P4P V4'g \R4hVfV'gVPR,pMhVR8Xd\ RRRR 7p\ V4pTPR ,P'd%\\T44^8d \R 4hV'g\P!R V R2RRR7\T;'gR4^,p \V ^,4p \V ^,4p V P!V\#4P%V4P'V4P)W4P+V4VVPR,4\P,!RV R24R# \d!p \R \T 4,4hRp ? ii;i \.d\\04hi;i)z Update the settings for a slot. Change the settings for a slot without changing the stored secret. All settings not specified will be written with default values. z6--new-access-code conflicts with --delete-access-code.r1zb--delete-access-code used without providing an access code (see "ykman otp --help" for more info).z1Not possible to update settings on an empty slot.NrGzEnter new access codeT)rHZconfirmation_promptrIrOz1Access code does not meet complexity requirement.zUpdate the settings for slot z,? All existing settings will be overwritten.r>r{zSettings for slot z updated.)rTrrKrUr?r#r3rJZstrZpin_complexityr)Zsetr@rAr6ZboolZupdate_configurationrrgZ use_numericpacingserial_usb_visiblerVrrY)r+r4Znew_access_codeZdelete_access_coderir|Zuse_numeric_keypadr}rZrWr2Z pacing_bitsZ pacing_10msZ pacing_20mss&&&&&&&&& r-settingsr~Rsf3G-NOO#''-"8"8 6   # # % 3 3D 9 9IJJ!!ggm4O c !*'DdO D3ODO 776? ) ) )c#o2F.G!.KMN N  +D629 9  fmm$*K{Q'K{Q'K '$$   ! Yu  [+ , VK -   2 3  GGM "   'vY789 D9CFBC C D: 'o&&'s%9 G61BH$6 H!HH!$H?r5)r{Z20Z40Z60)SZloggingrcrbZbase64rZ threadingrrr@Z yubikit.corerrZyubikit.core.otprrrrZyubikit.core.smartcardr Zyubikit.managementr Zyubikit.yubiotpr r r rrrrrrMrrrrrrrZ scancodesrrZutilrrrrr r!r"r#r$r%r&Z getLoggerZ__name__rQr0r3ZargumentZChoiceZclick_slot_argumentZoptionZclick_enter_optionrYrBrDZ pass_contextrTZcommandrOr[r]r_ZFilerjZIntRangernrqrvrwr6rzr~)r/r-rsX8  0 7)   0       8 $nn sCj)4P\\  4 E  ' -)<=>   F  :) ?:)z"J Y Y ''&dJ%UV I    'W'<''*  #     q\ $    r]     R    I    B      C  R r ~r j U+dL$5QR  2   ' O $  9 $'S,0$'N&  >     L    I ;' '2;'| e,  M   sCj !  P 1' -$1'h@ 3eD sCj !  - dKc1;RSdN);<E'=TE E'P   S D/Q - .  U   (   ? H'  DH'r/