+ :i=5c s^RIt^RIt^RIHt^RIt^RIHt^RIHt^RI H t H t H t ^RI HtHtHtHtHt^RIHt^RIHt^R IHtHtHt^R IHtHtHtHtHtH t H!t!H"t"H#t#H$t$H%t%]PL!]'4t(]!R ] .R ]PR9R 7]PT] R444t+]+PY4]PTR44t-]+PY4]PT]R444t.]+P_4R4t0Rt1Rt2]!4R4t3!RR]4t4]Pj!RR]4!4]!43]3R7t6]0PYR4]PT]6]Pj!R]Pn!R4RR7]Pp!RR ]!4^R!R"7R#44444t9]0PYR$4]PT]6]Pj!R%R&R'7]Pp!R(R)R*R+7]Pp!RR ]!4^R!R"7R,444444t:]0PY4]PT]6]Pj!R-]Pn!R4R.R7R/4444t;]0PYR04]PT]6]R14444t<]0PYR24]PT]6]Pj!R3R6]!4R47R54444t=R#)7iN)Any)x509) serialization)SW ApduErrorSmartCardConnection)KeyRefScp03KeyParamsScp11KeyParamsScpKid StaticKeys) CAPABILITY)SecurityDomainSession)InvalidPasswordErrorparse_certificatesparse_private_key) CliFailHexIntParamTypeclick_callbackclick_force_option click_groupclick_postpone_execution click_promptget_scp_params log_or_echoorganize_scp11_certificates pretty_printsdz --full-help)Z connectionsZhiddencsVPR,pVP\4pVPVP4\ V4p\ V\R4V4pV'dVPV4\V\4;'g@\V\4;'d(VPP\P8HVPR&W0PR&R#)zC Manage the Security Domain application, which holds keys for SCP. Zdevice authenticatedsessionN)objZopen_connectionrZ call_on_closeZcloser rr Z authenticate isinstancerrrefkidr SCP11a)ctxZdevZconnrZ scp_paramss& >/usr/lib/python3.14/site-packages/ykman/_cli/securitydomain.pysecuritydomainr&Es ''( C   2 3Ddjj!#D)GZ^T:JZ( :~. 0 0 j. 1 0 0 NN  &-- /GGO !GGIc svVPR,p.pVP4pVP4P4EFpVP^8Xd9TP RVP R R2VP ^8XdRMR./4KMVPR9dK`/pWC9d"RPRW4,44VR &VPV4Uu.uFqfPP4NK upVR &\VP4PpVP V R VPR R VP R R2V/4EK \P !RP\#RV/444R#uupi \dLi;i \dR pLi;i)z2 List keys in the Security Domain of the YubiKey. rzSCP03 (KID=0x01-0x03, KVN=0x02X)zDefault key setzImported key set:c3s("TFqR xK R#5i)r(N).0Zb& r% Zinfo..ys5S(Q3j(szCA Key IdentifierzCertificate chainz SCP11 OCE CAz (KID=0xz, KVN=0xZ zSCP keysN)i)rZget_supported_ca_identifiersZget_key_informationkeysr"Zappendkvnjoinget_certificate_bundleZsubjectZrfc4514_stringrr name ValueErrorclickechor)r$rdataZcasr!ZinnerZcr4s& r%infor9bs  BD ) ) +C%%',,. 77a< KK23773-qA-0WW_)BTD WW  $&Ez-0XX5S#(5S-S)* 8:8Q8QRU8V.8V1II,,.8V.)*  &cgg++ KKD6#''#hswwsm1MuU V3/6 JJtyyz4&89:;.   &% &s6F!"FF F(F F%$F%( F87F8csFRVP9d \R4hV'g\P!RRRR7\P!R4VPR,P 4\P!R4\P!R 4R #) z Reset all Security Domain data. This action will wipe all keys and restore factory settings for the Security Domain on the YubiKey. Zscpz6Reset must be performed without an active SCP session.z`WARNING! This will delete all stored Security Domain data and restore factory settings. Proceed?TZabortZerrz!Resetting Security Domain data...rzGReset complete. Security Domain data has been cleared from the YubiKey.z,Your YubiKey now has the default SCP key setN)rrr6confirmr7reset)r$forces&&r%r<r<sx NOO   )   JJ23GGI JJQ JJ=>r'csR#)zManage SCP keys.Nr+r+r'r%r0r0sr'csNVPR,'g \R4hR#)rz>This command requires authentication, invoke ykman with --scp.N)rr)r$&r% _require_authr?s" 77? # #VWW $r'cs\VRV4#r4)Zgetattr)Zfobjr>r%_fnamerAs 4 &&r'csJ\V!# \d \T4hi;i)N)rZAttributeErrorr5)r$paramZvals&&&r%click_parse_scp_refrCs*s| os "cs*a]tRt^toRtRtRtVtR#)ScpKidParamTyper"cs\V\4'dV#VP4RRVR,P4,p\V,# \ dTP4P R4'd\TR,^4u#RT9d\TPRR4^4u#\T4u# \dTPT: R2Y#4R#i;ii;i)N0x:r/NNr*z is not a valid integerr) r ZintZupperZlowerr ZKeyErrorZ startswithZreplacer5Zfail)ZselfvaluerBr$r4s&&&& r%convertZScpKidParamType.converts eS ! !L K;;="%b (99D$<  K K;;=++D11uRy"--%<u}}S"5r::5z! K UI%<=uJJ K KsM;A C8"$CCC8"C>C8 C C8!C4/C83C44C8r+N)__name__Z __module__Z __qualname__Z__firstlineno__r4rHZ__static_attributes__Z__classdictcell__)Z __classdict__s@r%rDrDs DKKr'rDkeyzKID KVN)metavartypeZcallbackZgeneratezpublic-key-outputZwbz PUBLIC-KEY)rLrKz-rz --replace-kvnz3replace an existing key of the same type (same KID))rLdefaulthelpcs\V4\P\P\P3pVP V9d(RP RV44p\RV R24hVPR,pVPWR7p\PP p TP#TP%T \P&P(R 74\+R T R \-T4 2\.T4R# \d1pTP\P8Xd \R4hhRp?ii;i) z Generate an asymmetric key pair. The private key is generated on the YubiKey, and written to one of the slots.  KID KVN key reference for the new key PUBLIC-KEY file containing the generated public key (use '-' to use stdout) z, c3sJ"TFpRVR RVP R2xK R#5i)rExz (r)Nr@)r,Zvr-r%r.Zgenerate_key..s%DeAa5166(!4es!#zKID must be one of .r) replace_kvnNo space left for SCP keys.N)encodingZformatzPrivate key generated for z, public key written to )r?r r#SCP11bSCP11cr"r2rrZgenerate_ec_keyrswrNO_SPACErEncodingPEMwrite public_bytesZ PublicFormatZSubjectPublicKeyInforrAlogger) r$rJZpublic_key_outputrQZvalidZ values_strr public_keyeZ key_encodings &&&& r% generate_keyr_s!,# ]]FMM6== 9E wweYYDeDD +J\@PB8Xd \9R4hhRp?ii;i)a Import a key or certificate. KID 0x01 expects the input to be a ":"-separated triple of K-ENC:K-MAC:K-DEK. KID 0x11, 0x13, and 0x15 expect the input to be a file containing a private key and (optionally) a certificate chain. KID 0x10, 0x20-0x2F expect the file to contain a CA-KLOC certificate.  KID KVN key reference for the new key INPUT SCP03 keyset, or input file (use '-' to use stdin) rr*NZrbTzError parsing file)Zexc_infozEnter password to decrypt filerFF)rMZ hide_inputZ show_defaultzWrong password.z3Input does not contain a valid CA-KLOC certificate.zInvalid value for KID=rOrPzKey stored for rRzCertificate bundle stored.zCA key identifier stored.)*r?rr"r ZSCP03Zput_keyr ZsplitZbytesZfromhexr6FilerHZreadr#rTrUZencoderr r\Zdebugrr7rrZlistZrangerr]rrVrrWZstore_certificate_bundleZ extensionsZget_extension_for_classrZSubjectKeyIdentifierZstore_ca_issuerrGZdigest)r$rJr`ZpasswordrQrZkZfiler8ZtargetZcaZbundleZleafZinterr^Zskis&&&&& r% import_keyrb s8#ggi G ww&,,ZEKKPSDT)UDTq%--*:DT)UVW ::d  # #E4 5D 99;D ww6==&--??##??, 2*4:7 t . D &\TF*F T.E$-. .56Ht6TU4OP P.swwqk;<<[1 _VHA./((5 /0 mm33D4M4MNYY%5%56 ./ q*V( 2 1D A#+8 "#'%*  H $HJJ011 2@  442;; 78 8 s6"J J ,K65K3K32K36 L1+L,,L1zcertificates-outputZOUTPUTcsVPR,p\VPV44Uu.uF-pVP\P P R7NK/ ppV'dCVPRPV44\RV R\V4 2\V4R#\RV R24huupi) z Export certificate chain for a key.  KID KVN key reference to output certificate chain for OUTPUT file to write the certificate chain to (use '-' to use stdout) r)rSr'zCertificate chain for z written to z No certificate chain stored for rPN) rZreversedr3r[rrXrYrZr2rrAr\r)r$rJZcertificates_outputrZcertZpemss&&& r%exportrcksggi GW;;C@A AD =#9#9#=#=>A   !!#((4.1$SEf=P6Q5R S   8Q?@@ s3B>Zdeletecs\V4VPR,pV'g\P!RRRR7VP VP VP 4\P!R4R # \d_pTP\P8Xd\RT R24hTP\P8Xd \R4hhR p?ii;i) z Delete a key or keyset. Deletes the key or keyset with the given KID and KVN. Set either KID or KVN to 0 to use it as a wildcard and delete all keys matching the specific KID or KVN  KID KVN key reference for the key to delete rz9WARNING! This will delete all matching SCP keys. Proceed?Tr:zSCP key deleted.zNo key stored in rPz>This would delete ALL SCP keys, use the reset command instead.N)r?rr6r; delete_keyr"r1r7rrVrZREFERENCE_DATA_NOT_FOUNDrZCONDITIONS_NOT_SATISFIED)r$rJr=rr^s&&& r%rdrds#ggi G  G 377CGG, %&  442.. .-cU!45 5 442.. .P  s#ggi G C) JJ5cU!<=r'r)>ZloggingZsysZtypingrr6Z cryptographyrZcryptography.hazmat.primitivesrZyubikit.core.smartcardrrrZyubikit.core.smartcard.scprrrr r Zyubikit.managementr Zyubikit.securitydomainr Zutilr rrrrrrrrrrrrrZ getLoggerrIr\ZargvZ pass_contextr&Zcommandr9r<Zgroupr0r?rArCrDZargumentZclick_key_argumentraZoptionr_rbrcrdrfr+r'r%rgsM8  8EE*8       8 $ *+M4Q! !0"<" &R&Rh)dL'VW   > O0X*O0d%EJJt,=>r'