+ :ivcs^RIt^RIt^RIHt^RIt^RIHt^RIHtH t ^RI H t H t ^RI HtHtHt^RIHt^RIHtHtHtHtHtHtHtHtHtHt^R IHtH t H!t!H"t"H#t#H$t$H%t%H&t&H't'H(t(H)t)H*t*H+t+^R I,H-t-H.t.H/t/H0t0^R I,H1t1H2t2H3t3H4t4H5t5H6t6H7t7H8t8H9t9H:t:H;t;H4t?]3!4R 4t@]3!4R 4tA]3!4R4tB]3!4R4tC]P!R]@R7tE]P!R]ARR7tF]P!RRR]BR7tH]P!RRRR7tI]P!R]2!]4]PPRR7tL]P!R ]2!]4]PPR!R7tM]P!R"R#]P!.ROR%R&7R$R'R(]CR)7tO]P!R*R'R'R'R+R,7tPR-tQ]6!].R.7]P]7R/444t]P4]PR044tT]P4]P]4R1444tU]P4R24tW]WPR34]P]P!R4]P!^^4R5R67]P!R7]P!^^4R8R67]H]I]4R94444444tYR:tZR;t[]WPR<4]P]P!RRR=R7]P!R>R?R@R7RA4444t\]WPRB4]P]P!RCRDRER7]P!R>RFRGR7RH4444t]]WPRI4]P]I]P!RJRKR'RLRM7]P!R>RNRO]BR7]P!RRRP]BR7]P!R"RQRR]2!]4RS7]P!RCRTR'RURM7]P!RVRWR'RXRM7]4RY4444444444t^]WPRZ4]P]P!RCRDR%R[7]P!R>R?R%R\R]7R^4444t_]P4R_4t`]`PR`4]P]H]I]P!R"RQRa]2!]4]PPR'Rb7]5]L]M]E]P!Rc]P!Rd4ReR67Rf4444444444tc]`PRg4]P]I]H]L]M]E]P!Rh]P!Ri4RjR67]P!RCRkRlR7Rm444444444td]`P4]P]5]E]P!Rn]P!Rd4RoR67Rp44444te]`PRq4]P]ERr444tf]`P4]P]5]E]P!RsRtR'RuRM7]P!RRRvR7]P!Rc]P!Rd4ReR67Rw4444444tg]`PRx4]P]H]I]P!Ry]@R7]P!Rz]@R7R{444444th]`PR|4]P]H]I]ER}44444ti]PR~4R4tjRtk]jPRg4]P]H]I]P!RCRkRR7]P!RsRtR'RRM7]P!RRR'RRM7]P]E]P!R]P!Ri4RoR67R4444444444tl]jPR4]P]5]E]P!Rn]P!Rd4RoR67R44444tm]jPR`4]P]H]I]E]P!R]P!Ri4ReR%R7]P!RRRR'R7]P!RRR]PRR'Rb7]O]PR4444444444to]jPR4]P]I]E]P!R]P!Ri4ReR67]P!R]P!Rd4RR67]P!RRRR'R7]OR44444444tp]jPR|4]P]H]I]E]PR444444tq]PR4R4tr]rPR4]I]P]F]P!R]P!Rd4RR67R44444ts]rPRg4]I]H]P]F]P!R]P!Ri4RR67R444444tt]rPR`4]I]H]P]FR44444tuRRltvRRltwRRltxRRltyRRltzRRlt{Rt|R#)N)uuid4)default_backend)hashes serialization) TRANSPORTNotSupportedError)SW ApduErrorSmartCardConnection) CAPABILITY) DEFAULT_MANAGEMENT_KEYKEY_TYPEMANAGEMENT_KEY_TYPE OBJECT_ID PIN_POLICYSLOT TOUCH_POLICYChuidInvalidPinError PivSession) check_keyderive_management_key generate_cccgenerate_chuid generate_csrgenerate_random_management_key generate_self_signed_certificate get_piv_infoget_pivman_dataget_pivman_protected_datapivman_change_pinpivman_set_mgm_keypivman_set_pin_attempts)InvalidPasswordErrorget_leaf_certificatesparse_certificatesparse_private_key) CliFail EnumChoiceclick_callbackclick_force_optionclick_format_option click_groupclick_postpone_execution click_promptget_scp_params log_or_echo pretty_printprompt_timeoutcs\VP4PRR4,# \d4\\ T^44u# \ d \ T4hi;ii;i)-_)rupperreplaceKeyErrorint Exception ValueErrorctxparamval&&&3/usr/lib/python3.14/site-packages/ykman/_cli/piv.pyclick_parse_piv_slotr@[sc"CIIK''S122 " "C % % "S/ ! ""s *- A+A A+A''A+csVP4R8Xd\P#\VP4PRR4,# \d+\ T^4u# \ d \T4hi;ii;i)ZCCCr2r3)r4rr r5r6r7r8r9r:r>r?click_parse_piv_objectrAfsx yy{e###",,S#677 " "sB<  "S/ ! ""s#*A B A,)B,BBcs\PV4pV'd\V4R9d \R4hV# \d \T4hi;i)z[Management key must be exactly 16, 24, or 32 bytes (32, 48, or 64 hexadecimal digits) long.)rBii )bytesfromhexlenr9r8)r;r<r=key&&& r?click_parse_management_keyrHssU mmC  3s8</;  os <<AcsX\\V4# \d \T4hi;iN)getattrrZAttributeErrorr9r:r>r?click_parse_hashrKs-vs## os)slot)callback object_idZOBJECT)rMmetavarz-mz--management-keyzthe management key)helprMz-Pz--pinzPIN code)rPz --pin-policyzPIN policy for slot)typedefaultrPz--touch-policyztouch policy for slotz-az--hash-algorithmSHA256F)Zcase_sensitiveTzhash algorithm)rQrR show_defaultrPrMz --update-chuid/--no-update-chuidz+update the CHUID GUID to a new random value)is_flagrRrTrPcs\VRV4#)name)rJ)Zfobj&r?_fnamerXs 4 &&)Z connectionscsVPR,pVP\4pVPVP4\ V\ PV4p\W#4pTPR,pY@PR&\#T4TPR&\ PTP$9;'d\ PTP&9TPR&R# \dXpTP\P8Xd3T'g+TP\P8Xd \!R4hhRp?ii;i)a Manage the PIV application. Examples:  Generate an ECC P-256 private key and a self-signed certificate in slot 9a: $ ykman piv keys generate --algorithm ECCP256 9a pubkey.pem $ ykman piv certificates generate --subject "CN=yubico" 9a pubkey.pem  Change the PIN from 123456 to 654321: $ ykman piv access change-pin --pin 123456 --new-pin 654321  Reset all PIV data and restore default settings: $ ykman piv reset Zdevicez)Unable to manage PIV over NFC without SCPNinfosession pivman_data fips_unready)objZopen_connectionr Z call_on_closeZcloser.r PIVrrswrCONDITIONS_NOT_SATISFIEDZ transportrZNFCr&r fips_capable fips_approved)r;ZdevZconnZ scp_paramsr[erZs& r?pivres0 ''( C   2 3Ddjj!Z^^T:J T. 776?D GGI,W5CGGM$+++XX dFXFX0XGGN  DDB// / .EF F s C55 E&E'+EEcsLVPR,p\VPR,4p\PVP9d(\PVP 9V^,R&\ P!RP\V444R#)z0 Display general status of the PIV application. rZr[z FIPS approved N) r^rr r_rbrcclickechojoinr0)r;rZdatas& r?rZrZsm 776?D  * +D~~***#->>T5G5G#GQ  JJtyyd+,-rYcsVPR,p\PVP9d \ R4hV'g\ P !RRRR7\ P!R4VPR,pVP4VP4P^8p\ P!R4V'dD\ P!R 4\ P!R 4\ P!R 4M,\ P!R 4\ P!R 4\ P!R 4R# \dRpLi;i)zz Reset all PIV data. This action will wipe all data and restore factory settings for the PIV application on the YubiKey. rZzbCannot perform PIV reset when FIDO is configured, use 'ykman config reset' for full factory reset.zTWARNING! This will delete all stored PIV data and restore factory settings. Proceed?TZabortZerrzResetting PIV data...r[z?Reset complete. All PIV data has been cleared from the YubiKey.z=Your YubiKey now has the default PIN, PUK and Management Key: PIN: 123456 PUK: 12345678z8Your YubiKey now has the default PIN and Management Key:zA Management Key: 010203040506070801020304050607080102030405060708N) r^r r_Z reset_blockedr&rgconfirmrhresetget_puk_metadataattempts_remainingr)r;forcerZr[Zhas_puks&& r?roros  776?D~~+++ ?    !   JJ&'ggi G MMO**,??!C JJPQ RS #$ %& MN #$ JJTU sE E+*E+cR#)z$Manage PIN, PUK, and Management Key.NrtrYr?accessru!rYz set-retriesz pin-retriesz PIN-RETRIES)rQrOz puk-retriesz PUK-RETRIEScsVPR,pVPR,p\PVP9dLVP 4P 'd!VP 4P 'g \R4hVP4\R4h \dMi;i\YTRTR7\P!R4T'g!\P!RT R T R 2RRR 7\YcT4\P!R 4\P!R 4\P!R4\P!R4R# \d \R4hi;i)zq Set the number of PIN and PUK retry attempts. NOTE: This will reset the PIN and PUK to their factory defaults. r[rZz>T%6%66aAGHTF"3^QGTFm^E   T$u%& 1'' *2b.XlJTF"3J<|LM MTF,/0 0  442.. .TF"HIJ J s+!A55 DAC DD.DDz change-pinzcurrent PIN codez-nz --new-pinza new PIN to setc saaaVPR,pVPR,oSP4'g \R4hS'g \R4oS'g\ RRRRRR 7o\ VR SSVVV3R l4R #) z Change the PIN code. The PIN must be between 6 and 8 bytes long, and supports any type of alphanumeric characters. For cross-platform compatibility, numeric PINs are recommended. rZr[PIN is blocked.zEnter the current PINzEnter the new PINTFrR hide_inputrTconfirmation_promptZPINcs<\SSS4#rI)r)new_pinr{r[r?Zchange_pin..s!'38rYN)r^Zget_pin_attemptsr& _prompt_pinr-r)r;r{rrZr[&ff @r? change_pinrys~ 776?Dggi G  # # % %'(( 12   $     8 rYz change-pukz-pz--pukzcurrent PUK codez --new-pukza new PUK code to setc sTaaaVPR,pVPR,oSP4P'g \R4hS'g \ R4oS'g\ RRRRRR 7o\VR SSVVV3R l4R # \dLOi;i) z Change the PUK code. If the PIN is lost or blocked it can be reset using a PUK. The PUK must be between 6 and 8 bytes long, and supports any type of alphanumeric characters. rZr[PUK is blocked.zEnter the current PUKzEnter the new PUKrTFrZPUKcs(<SPSS4#rI) change_puk)new_pukpukr[rr?rZchange_puk..s""30rYN)r^rprqr&rrr-r)r;rrrZr[rr?rrs 776?Dggi G '')<<<+, ,= 12   $     0     sB B B'&B'zchange-management-keyz-tz--touchz9require touch on YubiKey when prompted for management key)rUrPz--new-management-keyza new management key to setzcurrent management keyz --algorithmzmanagement key algorithm)rPrQz --protectzkstore new management key on the YubiKey, protected by PIN (a random key will be used if no key is provided)z-gz --generatezgenerate a random management key (implied by --protect unless --new-management-key is also given, can't be used with --new-management-key)c sfVPR,p VPR,'dV'd \R4hV'gV P4PpVPR,p \PV P9d/V\ P 39d\VP R24h\VVVVRVR7p V'dV'd \R4hV'dV PR8d \R 4hVPR ,p V 'gKV P'd9V'd\W WVR 7M!V'g\P !R R R R7V'gV'g V'd<\#V4pV'g(\P$!RVP'4 24M5V'd \R4h\(P+\-RR R R74p\1V4VP28wd\RVP2,4h\5WW%VR7\P$!R4R# \d\ P pELi;i \.d \R4hi;i \6d \R4hi;i)z Change the management key. Management functionality is guarded by a management key. This key is required for administrative tasks, such as generating key pairs. A random key may be generated and stored on the YubiKey, protected by PIN. r[r]zDYubiKey FIPS must be in FIPS approved mode prior to using --protect.rZ not supported on YubiKey FIPS.z;Enter the current management key [blank to use default key])rwmgm_key_promptrxz@Invalid options: --new-management-key conflicts with --generate.z,Require touch not supported on this YubiKey.r\rxzlThe current management key is stored on the YubiKey and will not be cleared if no PIN is provided. Continue?TrkzGenerated management key: zuNew management key not given. Remove the --force flag, or set the --generate flag or the --new-management-key option.zEnter the new management key)rrz(New management key has the wrong format.z8Management key has the wrong length (expected %d bytes).)touchZstore_on_devicezNew management key set.z#Changing the management key failed.N)rr)r^r&Zget_management_key_metadatakey_typerr ZTDESr r_rbrVryversionhas_stored_key _verify_pinrgrnrrhZhexrCrDr-r8rEZkey_lenr r) r;rz algorithmr{Znew_management_keyrZprotectgeneraterrr[rZZ pin_verifiedpivmans &&&&&&&&& r?change_management_keyrsVzggi G ww~7 R    1;;=FFI 776?D~~***y=P=U=U" -'' *2b.XlJ1*\JK K+, ,  442.. .EF F s+'B99 EAD EE+D??Ecrs)z Manage private keys. NrtrtrYr?keysrrvrYrz"algorithm to use in key generation)rPrQrRrTzpublic-key-outputZwbz PUBLIC-KEYc sVPR,'d \R4h\WV4VPR,p \WV4V P WWx4p Tp VP V P V \PPR74\RV R\V4 2\V4R#)z Generate an asymmetric key pair. The private key is generated on the YubiKey, and written to one of the slots.  SLOT PIV slot of the private key PUBLIC-KEY file containing the generated public key (use '-' to use stdout) r]zCYubiKey FIPS must be in FIPS approved mode prior to key generation.r[encodingformatzPrivate key generated in slot z, public key written to N) r^r&_check_key_support_fipsry generate_keywrite public_bytesr PublicFormatSubjectPublicKeyInfor/rXlogger) r;rLpublic_key_outputrzr{rr pin_policy touch_policyr[ public_key key_encodings &&&&&&&&& r?rrsL ww~ Q  CJ7ggi G#N3%%dzPJL! --BB    (.F # $ % ' rYZimportz private-keyZrbz PRIVATE-KEYz --passwordz(password used to decrypt the private keycshVPR,'d \R4hVPR,pVP4p VeVP4p\ W4p\T\P!TP44T4\YT4TP!Y4YV4\P!R TP" R24R# \ dJ\ PRRR7Tf\RR RR R 7pKRp\P!R 4Ki;i)z Import a private key from file. Write a private key to one of the PIV slots on the YubiKey.  SLOT PIV slot of the private key PRIVATE-KEY file containing the private key (use '-' to use stdin) r]z?YubiKey FIPS must be in FIPS approved mode prior to key import.r[TNzError parsing keyZexc_infozEnter password to decrypt keyrFrRrrTWrong password.zPrivate key imported into slot .)r^r&readr~r%r"rdebugr-rgrhrr Zfrom_public_keyrryZput_keyrV) r;rzr{rLZ private_keyrrpasswordr[rjs &&&&&&&& r? import_keyrs, ww~WXXggi G    D   (H +D;K  X % %k&<&<&> ?#N3 OODz@ JJ0 1=>-$  LL,tL <'3#!&   ,-  s C5D1D10D1 certificateZ CERTIFICATEcsVPR,pVPV4pTP TP TR74\ RT R\T4 2\T4R# \d \R4hi;i)a0 Generate an attestation certificate for a key pair. Attestation is used to show that an asymmetric key was generated on the YubiKey and therefore doesn't exist outside the device.  SLOT PIV slot of the private key CERTIFICATE file to write attestation certificate to (use '-' to use stdout) r[zAttestation failed.rz!Attestation certificate for slot written to N) r^ attest_keyrr&rrr/rXr)r;rLrrr[certrr?attestr s ggi G-!!$'d'''89 +D6f[>Q=RS -+,,-s A))BrZc sVPR,pVPV4pRTRVPPRVP'dRMRRVP PRVP P/p\P!R P\V444R # \d5pTP\P8Xd\R T R 24hhR p?ii;i) a  Show metadata about a private key. This will show what type of key is stored in a specific slot, whether it was imported into the YubiKey, or generated on-chip, and what the PIN and Touch policies are for using the key.  SLOT PIV slot of the private key r[zKey slotZ AlgorithmZOriginZ GENERATEDZIMPORTEDzPIN required for usezTouch required for userfNo key stored in slot rN)r^get_slot_metadatarrVZ generatedrrrgrhrir0rr`rREFERENCE_DATA_NOT_FOUNDr&)r;rLr[metadatarZrds&& r?rr'sggi G ,,T2  **// X%7%7%7kZ "H$7$7$<$< $h&;&;&@&@    499\$/01  442.. .24&:; ; s;B2AB22 C1=/C,,C1z-vz--verifyz>verify that the public key matches the private key in the slotzPIN code (used for --verify)csaa a VPR,o S PS4Po \P R4TpTPS PT\ P"P$R 74\'R S R \)T4 2\T4R# \ dCpTP \P8Xd\RS R24h\RS R24hRp?i\dS PS4P4o \P R4L \\ 3dvS PS4P4o \P R4T'dT T T3R lp\TS Yu4ELR \ d\RS R24hi;ii;ii;i) a Export a public key corresponding to a stored private key. This command uses several different mechanisms for exporting the public key corresponding to a stored private key, which may fail. If a certificate is stored in the slot it is assumed to contain the correct public key. If this is not the case, the wrong public key will be returned. The --verify flag can be used to verify that the public key being returned matches the private key, by using the slot to create and verify a signature. This may require the PIN to be provided.  SLOT PIV slot of the private key PUBLIC-KEY file to write the public key to (use '-' to use stdout) r[zPublic key read from YubiKeyrrz&Unable to export public key from slot Nz!Public key read using attestationz'Public key read from stored certificatecs<\RR7;_uu_4\SSS4'g\RS R24hRRR4R# +'giR#;i)?timeoutz7This public key is not tied to the private key in slot rNr1rr&)rr[rLrr? do_verifyZexport..do_verifyvsP+C88#,WdJ#G#G&-%,,06%4'"!"$H9888 #A A rzPublic key for slot r)r^rrrrrr`rrr&rrget_certificate_verify_pin_if_neededrrrrrr/rX) r;rLrrverifyr{rdrrrr[s &f&&&& @@r?exportrGs:ggi GP..t4??  346L! --BB    tfL8I1J0KLC H 442.. .24&:; ;>tfAFGG P P ++D1<<>J LL< =!9- P P$44T:EEG  FG"*#w G P FtfANOO P P PsM0B&& F=1=C.. F=;F==4D33F9;FFF=F55F99F=ZmovesourcedestcsW48Xd \R4hVPR,p\WV4VPW44\P !RVP RVP R24R# \d[pTP\P8Xd \R4hTP\P8Xd \R4hhRp?ii;i) z Moves a key. Moves a key from one PIV slot into another.  SOURCE PIV slot of the key to move DEST PIV slot to move the key into z#SOURCE must be different from DEST.r[zKey moved from slot z to slot rzDEST slot is not empty.zNo key in SOURCE slot.N) r&r^rymove_keyrgrhrVrr`rINCORRECT_PARAMETERSr)r;rzr{rrr[rd&&&&& r?rrs ~;<<ggi G#N3& )&++i {!LM  442** *34 4 442.. .23 3 sAA66 CACCZdeletecs4VPR,p\WV4VPV4\P!RVP R24R# \ d5pTP\P8Xd\RT R24hhRp?ii;i)zd Delete a key. Delete a key from a PIV slot on the YubiKey.  SLOT PIV slot of the key r[z Key in slot deleted.rrN) r^ry delete_keyrgrhrVrr`rrr&)r;rzr{rLr[rdrr?rrsggi G#N34  \$))I67  442.. .24&:; ; s5A B#/BBZ certificatescrs)z Manage certificates. By default, modifying the certificate in a slot will also update the CHUID with a new random GUID. To prevent this, use the --no-update-chuid option. NrtrtrYr?rrrvrYcstVP\P4p\P!V4pTP'd\ PR4R#\4PTn \T4p\ PR4TP#\PT4R# \ d\ PR4R#i;i \dJpTP\P8Xd%\ PR4\!4pRp?LhRp?ii;i)zLeaving unparsable CHUID as-isNzLeaving signed CHUID as-iszUpdating CHUID GUIDzGenerating new CHUID) get_objectrCHUIDrZ from_bytesr9rrZasymmetric_signaturerrCZguidrr`rFILE_NOT_FOUNDr put_object)r[Z chuid_dataZchuidrds& r? _update_chuidrs'' 8  $$Z0E  % % % LL5 6 W]] 5\  *+ y 3!  LL9 :    442$$ $ LL/ 0')J  sKC#B<C# C#!9C#< C C#C  C## D7.>D21D22D7z,a password may be needed to decrypt the dataz?verify that the certificate matches the private key in the slotz-cz --compressz)compresses the certificate before storingrc szaaaaVPR,oVP4p VeVP4p\W4p \T 4^8d\T 4p T ^,p M T ^,p \YT4T'dT P4oSPS4p T P\ P"\ P$39d!TPR ,p\'TSY4T P(\*P"\*P,39dR oMR oTTTT3Rlp\;TSTT4SP=SY4T'd \?S4\P!RSP@ 24R# \dL\ P RRR7Tf\RRRRR 7pEKRp\P!R 4EKi;i \.d5pTP0\2P48Xd\7RS R24hhRp?i\8dRoELi;i)z Import an X.509 certificate. Write a certificate to one of the PIV slots on the YubiKey.  SLOT PIV slot of the certificate CERTIFICATE file containing the certificate (use '-' to use stdin) r[TNzError parsing certificaterz%Enter password to decrypt certificaterFrrr\>@No private key in slot rrcs<\SR7;_uu_4\SSS4'g\RS R24hRRR4R# +'giR#;i)rzIThe public key of the certificate does not match the private key in slot rNr)rr[rLrsr?rZ%import_certificate..do_verify?sO00 $ ;;!//3fA7<1000rzCertificate imported into slot )!r^rr~r$r"rrr-rgrhrEr#ryrrrrALWAYSZONCErrrCACHEDrr`rrr&rrput_certificaterrV)r;rzr{rLrrrZcompress update_chuidrjZcertsZleafsZcert_to_importrrrdrrr[rs&&&f&&&&& @@@r?import_certificaters:ggi G 99;D   (H &t6E  5zA~&e,qq#N3 #..0  006H""z'8'8*//&JJ/C&6$$)<)Q>Q(RR   c7Is; D.;g JJ0 <=w$  LL4tL D';#!&   ,-  N ttr222 7vQ?@@   G sB FBG,/G,5G) G)(G), H:7/H&& H:3H:9H:rcsbVPR,pVPV4pVPVPVR74\ RV R\ V4 2\ V4R# \d;pTP\P8Xd \R4h\R4hRp?ii;i)z Export an X.509 certificate. Reads a certificate from one of the PIV slots on the YubiKey.  SLOT PIV slot of the certificate CERTIFICATE file to write certificate to (use '-' to use stdout) r[rzCertificate from slot z exported to zNo certificate found.zFailed reading certificate.N) r^rrrr/rXrrr`rrr&)r;rrLrr[rrds&&&& r?export_certificaterOsggi G 9&&t,$++V+<=$TF-{8K7L M   9 442$$ $12 278 8 9sAA)) B.45B))B.z public-key)rQrOrz-sz --subjectz2subject for the certificate, as an RFC 4514 string)rPrz-dz --valid-daysz,number of days until the certificate expiresimc sdVPR,p V PV4p V P\P\P 39dRp MRp V'd1VP4p \P!V \44pM7V P R8d \R4hV PV4P"p\$P$P'\$P(P*4pV\$P,!VR 7,pR V9d R V,p\/WVR R 7\1V R7;_uu_4\3WWEWV4pRRR4V P5VX4V'd \7V 4\8P:!RVP< R24R# \ d5p T P\P8Xd\RT R24hhRp ? i\dRp ELi;i +'giL;i \ d \R4hi;i)a; Generate a self-signed X.509 certificate. A self-signed certificate is generated and written to one of the slots on the YubiKey. A private key must already be present in the corresponding key slot.  SLOT PIV slot of the certificate PUBLIC-KEY file containing a public key (use '-' to use stdin) r[rrrrNrz-PUBLIC-KEY required for YubiKey prior to 5.4.)Zdays=CN=T)rwrzCertificate generated in slot zCertificate generation failed.)irr)r^rrrrrrr`rrr&rrrload_pem_public_keyrrrdatetimenowZtimezoneZutcZ timedeltaryr1rrrrgrhrV)r;rzr{rLrsubjectZ valid_dayshash_algorithmrr[rrrdrjrZvalid_tors&&&&&&&&& r?generate_certificaternsZggi G ,,T2  \%8%8,:M:M$N NGG "66t_=NO 9 $EFF..t4??      1 1 5 5 6CX''Z88H ''/#NM 8 G , ,3zC>D- d+  ' " 3DII;a@AC  442.. .3D6;< < ,- , 86778sTAF4F4>HH!!H/H4 H?/G.. H;HH H HH/Zrequestz csr-outputZCSRzRC- S%%}/E/E/I/I%JK v\&*<)=> #  442.. .3D6;< < - , HFGGHsU'AD?*D?:F"FF"? F  /E99 F F  F  F F"F""F9csVPR,p\WV4VPV4V'd \V4\P !RVP R24R#)z| Delete a certificate. Delete a certificate from a PIV slot on the YubiKey.  SLOT PIV slot of the certificate r[zCertificate in slot rN)r^rydelete_certificaterrgrhrV)r;rzr{rLrr[s&&&&& r?rr sOggi G#N3 t$g JJ%dii[ :;rYobjectscrs)aY Manage PIV data objects. Examples:  Write the contents of a file to data object with ID: abc123: $ ykman piv objects import abc123 myfile.txt  Read the contents of the data object with ID: abc123 into a file: $ ykman piv objects export abc123 myfile.txt  Generate a random value for CHUID: $ ykman piv objects generate chuid NrtrtrYr?rr rvrYoutputZOUTPUTcsXaaaaaaaSPR,oSPR,oSPR,'dOS\P\P\P\P 39d \ R4hRVVVVVVV3RlloS!4R#)z Export an arbitrary PIV data object.  OBJECT name of PIV data object, or ID in HEX OUTPUT file to write object to (use '-' to use stdout) r[r\r]zAYubiKey FIPS must be in FIPS approved mode to export this object.cs<SPSPS44\RS R\S4 2\S4R# \ dupTP \P8Xd \R4hTP \P8Xd&T'd\SSSS4S!RR7Rp?R#hRp?ii;i)zExported object z to zNo data found.F)retryN) rrr/rXrrr`rrr& SECURITY_CONDITION_NOT_SATISFIEDr) rrdr;do_read_objectrNrr{rr[s & r?rZ#read_object..do_read_objectOs  LL++I6 7 "9+T&.1ABFF  ttr(((.//<<<C&#6U++ s%AA CAB?!B?>B??CN)T)r^rPRINTEDZ FINGERPRINTSZFACIALZIRISr&)r;r{rNrrrr[sffff@@@r? read_objectr5sggi G WW] #F ww~9 1$  O    rYrjZDATAcsVPR,p\PV8Xd1VPR,pVP'd \ R4h\ WV4VP W4P44\P!R4R# \d;pTP\P8Xd \ R4h\ R4hRp?ii;i)a Write an arbitrary PIV object. Write a PIV object by providing the object id. Yubico writable PIV objects are available in the range 5f0000 - 5fffff.  OBJECT name of PIV data object, or ID in HEX DATA file containing the data to be written (use '-' to use stdin) r[r\zFCan't write to slot 0x5fc109 while management key is protected by PIN.zObject imported.z-Something went wrong, is the object id valid?zError writing object.N)r^rrhas_protected_keyr&ryrrrgrhrr`rr)r;r{rzrNrjr[rrds&&&&& r? write_objectras&ggi GI%'  # # #X #N3/9iik2 %& / 442** *IJ J-../s&5B C"(5CC"cs~VPR,p\WV4\PV8Xd*VP \P\ 44MI\P V8Xd*VP \P \44M \R4h\P!R4R#)z Generate and write data for a supported data object.  Supported data objects: "CHUID" (Card Holder Unique ID) "CCC" (Card Capability Container)  OBJECT name of PIV data object, or ID in HEX r[z#Unsupported object ID for generate.zObject generated.N) r^ryrrrrr rr&rgrh)r;r{rzrNr[s&&&& r?generate_objectrs~$ggi G#N3)#9??N,<=    *9//@;<< JJ"#rYcs\VRRRR7pVR8Xd\#\PV4# \d \ R4hi;i)rTFrz$Management key has the wrong format.)r-r rCrDr8r&)promptrzs& r?_prompt_management_keyrsT!t%N%%>}}^,, ><==>s 3A cs \VRRRR7#)rTFr)r-)rrWr?rrs t% PPrYcsVPR,pVPR,pVP'd*V'g"\WWqVR7'g \R4hR#\ WW$VR7V'd\WWqVR7R#R#)r[r\rz5Failed to authenticate with protected management key.TN)r^rrr& _authenticate)r;r{rzrwrrxr[rr|r?ryrysoggi G WW] #F 3 JJQR R#)TC&CrYcsXV'gV'd \R4h\4pRpVPV4VP'dU\ 4;_uu_4VP \ W2P44RRR4RpVPV4V#VP'dV\V4p\ 4;_uu_4VP VP4RRR4RpVPV4V# +'giL;i +'giL8;i \d\PRRR7L]i;i \d3pTPpT^8d\RT R24h\R4hRp?i\d \R 4hi;i) z PIN required.FNTz$Failed to read stored management keyrzPIN verification failed, rrzPIN verification failed.)r&rZ verify_pinZhas_derived_keyr1 authenticaterZsaltrrrFr8rZwarningrrq) r;r[rr{rxZ authenticatedZ pivman_protrdrs &&&&& r?rrsh  /* *-CM23  ! ! !!!$$%:3 %LM" M   s #& % " " " V7@ #%%((9& $    s # -"!&% VEPTU V -'' a<5hZ|LM M+, , 20112s}"E E%D E E3D/D, D/6E D E D, 'D//"EEEE F)"-F F) F)csV!4# \dfpTP\P8XdA\P R4TP R,p\YYcT4Rp?T!4#hRp?ii;i)z:Command failed due to PIN required, verifying and retryingr\N)rr`rrrrr^r)r;r[Zfuncr{rxrdrrr?rrshv  44266 6 LLU VWW]+F f9 = = 6M  s A9AA43A44A9cs&V'g.V'd \R4hVf \4pM \V4p\4;_uu_4VPV4RRR4R# +'giR#;i \d \R4hi;i)zManagement key required.Nz*Authentication with management key failed.)r&rr1rr8)r;r[rzrrxs&&&&&r?rrst  45 5%!7!9!7!GD      0    DBCCDs)A9 A%A9% A6 0A96A99BcsHVPR,p\PVP9dpV\P \P 39d\RVP R24hV\P39d\RVP R24hR#R#)rZz Key type rz PIN policy N) r^r r_rbr ZRSA1024ZX25519r&rVrZNEVER)r;rrrZrGr?rrs 776?D~~*** (((//: :Ihmm_4STU U ***, ,joo..MN  -+rY)rSZSHA384ZSHA512)z1Enter a management key [blank to use default key])z Enter PIN)NNFNF)F)NF)}rZloggingZuuidrrgZcryptography.hazmat.backendsrZcryptography.hazmat.primitivesrrZ yubikit.corerrZyubikit.core.smartcardrrr Zyubikit.managementr Z yubikit.pivr r r rrrrrrrrerrrrrrrrrrrr r!Zutilr"r#r$r%r&r'r(r)r*r+r,r-r.r/r0r1Z getLoggerZ__name__rr@rArHrKZargumentZclick_slot_argumentZclick_object_argumentZoptionZclick_management_key_optionZclick_pin_optionZDEFAULTrVZclick_pin_policy_optionZclick_touch_policy_optionZChoiceZclick_hash_optionZclick_update_chuid_optionrXZ pass_contextZcommandrZroZgroupruZIntRanger}rrrrrrrZRSA2048ZFilerrrrrrrrrrrZINTrrrrrrrrrryrrrrrtrYr?rsl 8 8@5EE)          8 $"" " "  nnV6JK0($ll  '  <<gJ?,, J     # #   "LL L !  % %  LL 4U K   "LL&   6 ' -./*0*Z . .'V'VT/ /  ENN1c$:MR ENN1c$:MR)5SS)5XR, dG"45dK&89:6D dG"45dK&=>"?6"J'(  D   & '   ! '   # ' (    8   / f=    )Vf=R dGe,dK%C%D-%P  j - H     ! ! #%**T*:LQ,R",^h EJJt$4mLdL'QR/?SM/?d EJJt$4mLM 0f:  I  dG"@A#%**T*:LQ:RB :zf#78!5679 2h (>40hdL'UV  J  ,+VUZZ-}EP>F W"P>fh EJJt$4mL9M 94juzz$' =    7   @8 0@8Fi 5::d#3\J 5::d#3UC G   0 DK0fh< <"9( uzz$/B$C $N UZZ-v>/? /B $ $0 >Q0"J  D rY