+ :iuYcs^RIHt^RIt^RIt^RIHt^RIHtHt^RI H t ^RI H t ^RI Ht^RIHt^R IHt^R IHt^R IHtHtHtHtHtHtHt^R IHtHtH t H!t!H"t"H#t#]PH!]%4t&^qt'^rt(^st)^tt*^ut+^vt,^wt-^xt.^yt/^zt0^{t1^|t2^}t3^t4^t5^t6^t7^t8^t9^t:^t;^ t<^ t=^ t>^t?^t@^tA^@tBR tC^tD]!RR]44tERRltFRRltGRtHRRltIRtJ] ]!RRR7!RR444tK!RR] 4tL!RR 4tMR#)!) annotationsN) dataclass)IntEnumunique)total_ordering) NamedTuple)default_backend)hashes)ec) PBKDF2HMAC)InvalidPinErrorTlvVersion_override_version bytes2int int2bytesrequire_version)AIDSW ApduError ScpKeyParamsSmartCardConnectionSmartCardProtocolscsH]tRt^htRt^&t^'t]RRl4t]R4t Rt R#) ALGORITHMz(Algorithms for YubiHSM Auth credentials.cV^8dQhRR/#returnintZformat"4/usr/lib/python3.14/site-packages/yubikit/hsmauth.py __annotate__ZALGORITHM.__annotate__ps...c sVPPR4'd^#VPPR4'd^ #\R4h)ZAES128EC_P256zUnknown algorithm)name startswith ValueErrorself&r!key_lenZALGORITHM.key_lenos> 99   ) ) YY ! !) , ,,--r#c sLVPPR4'd^@#R#)r$N)r%r&r(r*r! pubkey_lenZALGORITHM.pubkey_lenws 99   * * +r#rN) __name__ __module__ __qualname____firstlineno____doc__AES128_YUBICO_AUTHENTICATIONEC_P256_YUBICO_AUTHENTICATIONpropertyr+r,__static_attributes__rr#r!rrhs72#% $&! ..r#rc V^8dQhRRRR/#)rcredential_password bytes | strrbytesrrr r!r"r"}s  K E r#cs\V\4'd&VP4P\R4pM \ V4p\ V4\8wd\R\,4hV#)sz)Credential password must be %d bytes long) isinstancestrencodeZljustCREDENTIAL_PASSWORD_LENr9lenr')r7Zpw& r!_parse_credential_passwordr@}sa%s++ ' ' ) / /0G O & ' 2w)) 7:Q Q   Ir#cr6)rlabelr;rr9rrr r!r"r"s    r#csVP4p\T4\8g\T4\ 8d\R\\ 3,4hT# \d \T4hi;i)z*Label must be between %d and %d bytes long)r<Z Exceptionr'r> MIN_LABEL_LEN MAX_LABEL_LEN)rAZ parsed_labelr?r! _parse_labelrDsn ||~  <=(C ,= ,M 8m, -      s AA/csd\P!\V4p\P!V4#N)r unpack TAG_VERSIONr Z from_bytes)responsedatar?r! _parse_selectrJs# ::k8 ,D   d ##r#cr6)rpasswordr;rztuple[bytes, bytes]rrr r!r"r"ss':r#csVP4p\\P!4^ RR\ 4R7P V4pVR,VR,rCW43#)zmDerive encryption and MAC key from a password. :return: A tuple containing the encryption key, and MAC key. sYubicoi') algorithmlengthZsaltZ iterationsZbackendNNrONN)r<r rZSHA256rZderive)rKZpw_byteskeykey_enckey_macs& r!_password_to_keyrTs[  H --/ !    fX 3xSW  r#csPVR,\P8Xd VR,#R#)iNi)rZVERIFY_FAIL_NO_RETRY)swr*r!_retries_from_swrVs! F{b---G| r#FT)ZorderZfrozencs\]tRt^t$RtR]R&R]R&R]R&R]R &R tR tR R ltRt R#) Credentialz!A YubiHSM Auth credential object.r;rArrLrcounterz bool | Nonetouch_requiredc srVPP4pVPP4pW#8#rE)rAZlower)r)otherZaZb&& r!__lt__ZCredential.__lt__s- JJ    KK   u r#c s4VPVP8H#rE)rA)r)rZs&&r!__eq__ZCredential.__eq__szzU[[((r#crrrrr r!r"ZCredential.__annotate__s  # r#c s,\VP4#rE)ZhashrAr(r*r!__hash__ZCredential.__hash__sDJJr#rN) r-r.r/r0r1__annotations__r\r]r^r5rr#r!rWrWs1, J L )  r#rWcsP]tRt^t$RtR]R&R]R&R]R&]RRl4tRtR #) SessionKeyszYubiHSM Session Keys.r9key_senckey_smac key_srmaccr6)rrHr9rr`rrr r!r"ZSessionKeys.__annotate__s   U  {  r#c sNVR,pVR,pVR,pV!VVVR7#)rN:rO N:rdi0N)rarbrcr)ZclsrHrarbrcs&& r!parseZSessionKeys.parses3C=E?UO   r#rN) r-r.r/r0r1r_Z classmethodrer5rr#r!r`r`s'OO    r#r`cs8]tRt^tRtR,RRllt]RRl4tRRltR R lt R-R R llt R-R Rllt R-RRllt R-RRllt R-RRlltRRltRRltRRltRRltRRltRR ltR!R"ltR.R#R$lltR,R%R&lltR'R(ltR,R)R*lltR+tR#)/HsmAuthSessionz,A session with the YubiHSM Auth application.Nc$V^8dQhRRRRRR/#)r connectionrscp_key_paramszScpKeyParams | NonerNonerrr r!r"HsmAuthSession.__annotate__s( 3 3' 3, 3  3r#c sP\V4Vn\P!\ VPP \ P444VnVPPVP4V'dVPPV4R#R#rE) rprotocolrZpatchrJZselectrZHSMAUTH_versionZ configureZinit_scp)r)rhris&&&r!__init__ZHsmAuthSession.__init__so **5 )// $--..s{{; <    .  MM " "> 2 r#cr)rrr rrr r!r"rksr#c sVP#)z%The YubiHSM Auth application version.)rmr(r*r!versionZHsmAuthSession.versions}}r#cr)rrrjrrr r!r"rksEEtEr#c stVPP^\^^4\P R4R#)z8Perform a factory reset on the YubiHSM Auth application.z-YubiHSM Auth application data reset performedN)rl send_apdu INS_RESETloggerinfor(r*r!resetZHsmAuthSession.resets' 9dD9 CDr#cr)rrzlist[Credential]rrr r!r"rks  "2 r#c  s.p\P!VPP^\^^44Fp\P !\ V4p\V^,4p\V^,4pVP^, pV^^V,P4pVR,pVP\WtW44K V#)z(List YubiHSM Auth credentials on YubiKeyi) r Z parse_listrlrpINS_LISTrFTAG_LABEL_LISTrboolrMZdecodeZappendrW) r)ZcredsZtlvrIrLrYZ label_lengthrArXs & r!list_credentialsZHsmAuthSession.list_credentialss>>$--"9"9!Xq!"LMC::nc2D!$q'*I!$q']N::>LQ-.557E2hG LLEgN ON r#cs4V^8dQhRRRRRRRRRR R R R R /#)rmanagement_keyr9rAr;rQrLrr7r8rYrwrrWrrr r!r"rk sY2S2S2S2S 2S  2S ) 2S2S 2Sr#c  s\V4\8wd\R\,4h\\V4\\ \ V44,\\\V44,pV\P8Xd<V\\VR,4\\VR,4,, pM,V\P8XdV\\V4, pV\\\!V44, pV'd"V\\"\^44, pM V\\"\^44, p\$P'RV RV RV R24VP(P+^\,^^V4\$P/R4\9Y$\:T4# \0d1p\3TP44p T fh\7T R T R 2R 7hRp?ii;i) $Management key must be %d bytes longrNrPz)Importing YubiHSM Auth credential (label=z, algo=z, touch_required=Z)zCredential importedNInvalid management key,  attempts remainingZattempts_remainingZmessage)r>MANAGEMENT_KEY_LENr'r TAG_MANAGEMENT_KEY TAG_LABELrD TAG_ALGORITHMrrr2 TAG_KEY_ENC TAG_KEY_MACr3TAG_PRIVATE_KEYTAG_CREDENTIAL_PASSWORDr@ TAG_TOUCHrrZdebugrlrpINS_PUTrsrrVrUr rWINITIAL_RETRY_COUNTER) r)ryrArQrLr7rYrIeretriess &&&&&&& r!_put_credentialZHsmAuthSession._put_credential s ~ "4 469KK  "N 3)\%01 2-9!56 7  >> > C SX.[#c(1KK KD )AA A C- -D  #%?@S%T    C 9Q<0 0D C 9Q<0 0D 7wgi[Q,-Q 0   MM # #Aw1d ; KK- .%,A>RR &qtt,G!#*27);NO   s<8G H+G;;Hcs4V^8dQhRRRRRRRRRRR R R R /#) rryr9rAr;rRrSr7r8rYrwrrWrrr r!r"rk=sP! ! ! !  !  ! ) ! !  ! r#c s\PPp\V4V8wg\V4V8wd \ RV4hVP VVW4,\PVV4#)aSImport a symmetric YubiHSM Auth credential. :param management_key: The management key. :param label: The label of the credential. :param key_enc: The static K-ENC. :param key_mac: The static K-MAC. :param credential_password: The password used to protect access to the credential. :param touch_required: The touch requirement policy. z,Encryption and MAC key must be %d bytes long)rr2r+r>r'r)r)ryrArRrSr7rYZaes128_key_lens&&&&&&& r!put_credential_symmetricZ'HsmAuthSession.put_credential_symmetric=sn(#??GG w<> )S\^-K> ##      2 2     r#c s0V^8dQhRRRRRRRRRR R R /#) rryr9rAr;derivation_passwordr7r8rYrwrrWrrr r!r"rk`sF    !  )      r#c sB\V4wrgVPWWgWE4#)alImport a symmetric YubiHSM Auth credential derived from password. :param management_key: The management key. :param label: The label of the credential. :param derivation_password: The password used to derive the keys from. :param credential_password: The password used to protect access to the credential. :param touch_required: The touch requirement policy. )rTr)r)ryrArr7rYrRrS&&&&&& r!put_credential_derivedZ%HsmAuthSession.put_credential_derived`s-$,,?@,, 75H  r#c s0V^8dQhRRRRRRRRR R R R /#) rryr9rAr; private_keyz+ec.EllipticCurvePrivateKeyWithSerializationr7r8rYrwrrWrrr r!r"rkxsG! ! ! ! A ! ) !  !  ! r#c s\\VPR4\VP\P 4'g \ R4h\PPpVP4pVPVV\VPV4\PVV4#)a{Import an asymmetric YubiHSM Auth credential. :param management_key: The management key. :param label: The label of the credential. :param private_key: Private key corresponding to the public authentication key object on the YubiHSM. :param credential_password: The password used to protect access to the credential. :param touch_required: The touch requirement policy. Unsupported curveir)rror:curver SECP256R1r'rr3r+Zprivate_numbersrrZ private_value)r)ryrArr7rYZlnnumbersrr!put_credential_asymmetricZ(HsmAuthSession.put_credential_asymmetricxs&  i0+++R\\::01 1  4 4 < <--/##   g++R 0  3 3     r#c ,V^8dQhRRRRRRRRR R /#) rryr9rAr;r7r8rYrwrrWrrr r!r"rks<    )      r#c sv\VPR4VPVVR\PVV4#)aGenerate an asymmetric YubiHSM Auth credential. Generates a private key on the YubiKey, whose corresponding public key can be retrieved using `get_public_key`. :param management_key: The management key. :param label: The label of the credential. :param credential_password: The password used to protect access to the credential. :param touch_required: The touch requirement policy. r#r)rrorrr3)r)ryrAr7rY&&&&&r!generate_credential_asymmetricZ-HsmAuthSession.generate_credential_asymmetrics=&  i0##     3 3     r#cr6)rrAr;rec.EllipticCurvePublicKeyrrr r!r"rks Q QC Q,E Qr#c s \VPR4\\\ V44pVP P ^\^^V4p\PP\P!4V4#)zGet the public key for an asymmetric credential. This will return the long-term public key "PK-OCE" for an asymmetric credential. :param label: The label of the credential. r) rror rrDrlrpINS_GET_PUBLIC_KEYr ZEllipticCurvePublicKeyZfrom_encoded_pointr)r)rArIresr[r!get_public_keyZHsmAuthSession.get_public_keys_  i09l512mm%%a);Q4H((;;BLLNCPPr#crg)rryr9rAr;rrjrrr r!r"rks!cdr#c s\V4\8wd\R\,4h\\V4\\ \ V44,pVPP^\^^V4\PR4R# \d1p\TP4pTfh\TRT R2R7hRp?ii;i)zyDelete a YubiHSM Auth credential. :param management_key: The management key. :param label: The label of the credential. rzzCredential deletedNr{r|r})r>r~r'r rrrDrlrp INS_DELETErrrsrrVrUr )r)ryrArIrr&&& r!delete_credentialZ HsmAuthSession.delete_credentials ~ "4 469KK %~6 |E*:    MM # #Az1a > KK, - &qtt,G!#*27);NO   s8B C+C  Ccrg)rrIr9use_management_keyrwrrjrrr r!r"rks$/3 r#c s4\VPR4VPP^\V'd^M^^V4\ P R4R# \d1p\TP4pTfh\TRT R2R7hRp?ii;i)rzCredential password changedNzInvalid auth, r|r})rir) rrorlrpINS_CHANGE_CREDENTIAL_PASSWORDrrrsrrVrUr )r)rIrrrs&&& r!_change_credential_passwordZ*HsmAuthSession._change_credential_passwords  i0  MM # #.'Q   KK5 6 &qtt,G!#*( 1DE   sAA B'+BBcs(V^8dQhRRRRRRRR/#)rrAr;r7r8new_credential_passwordrrjrrr r!r"rks2666)6"- 6  6r#c s\\\V44\\\ V44,\\\ V44,pVP VR4R#)zChange the password of a YubiHSM Auth credential. :param label: The label of the credential. :param credential_password: The current credential password. :param new_credential_password: The new credential password. FN)r rrDrr@r)r)rAr7rrI&&&& r!change_credential_passwordZ)HsmAuthSession.change_credential_passwords^  <. /')CDW)X '*+BC    ((u5r#cs(V^8dQhRRRRRRRR/#) rrAr;ryr9rr8rrjrrr r!r"rks25555"- 5  5r#c s\V4\8wd\R\,4h\\\ V44\\ V4,\\\V44,pVPVR4R#)zChange the password of a YubiHSM Auth credential with management key. :param label: The label of the credential. :param management_key: The management key. :param new_credential_password: The new credential password. rzTN) r>r~r'r rrDrrr@r)r)rAryrrIrr! change_credential_password_adminZ/HsmAuthSession.change_credential_password_adminsy ~ "4 469KK   <. /$n5 6'*+BC   ((t4r#cs$V^8dQhRRRRRR/#)rryr9new_management_keyrrjrrr r!r"rk+s(!!!"!  !r#c s\V4\8wg\V4\8wd\R\,4h\\V4\\V4,pVP P ^\^^V4\PR4R# \d1p\TP4pTfh\TRT R2R7hRp?ii;i)zChange YubiHSM Auth management key :param management_key: The current management key. :param new_management_key: The new management key. rzzNew management key setNr{r|r})r>r~r'r rrlrpINS_PUT_MANAGEMENT_KEYrrrsrrVrUr )r)ryrrIrrrr!put_management_keyZ!HsmAuthSession.put_management_key+s  #5 5%&*<<69KK %~6  2:    MM # #A'=q!T J KK0 1 &qtt,G!#*27);NO   s%8B C*+CCcrrrrr r!r"rkNsCr#c s\VPP^\^^4p\V4#)z(Get retries remaining for Management key)rlrpINS_GET_MANAGEMENT_KEY_RETRIESr)r)rr?r!get_management_key_retriesZ)HsmAuthSession.get_management_key_retriesNs)mm%%a)GAN~r#c s0V^8dQhRRRRRRRRR RR R/#) rrAr;contextr9r7r8 card_crypto bytes | None public_keyrrrr r!r"rkTsF    )  "  !   r#c s \\\V44\\V4,pV'dV\\V4, pV'dV\\ V4, pV\\ \V44, pVPP^\^^V4p\PR4V# \d1p\TP4p T fh\!T RT R2R7hRp?ii;i)rzSession keys calculatedNzInvalid credential password, r|r})r rrD TAG_CONTEXTTAG_PUBLIC_KEY TAG_RESPONSErr@rlrp INS_CALCULATErrrsrrVrUr ) r)rArr7rrrIrrrs &&&&&& r!_calculate_session_keysZ&HsmAuthSession._calculate_session_keysTs9l512Sg5NN  C 3 3D  C k2 2D  #%?@S%T   --))!]Aq$GC KK1 2  &qtt,G!#*7y@ST   s8C D+C>>Dc r) rrAr;rr9r7r8rrrr`rrr r!r"rkvs<    )  "    r#c  sR\PVPVVVVR74#)a+Calculate session keys from a symmetric YubiHSM Auth credential. :param label: The label of the credential. :param context: The context (host challenge + hsm challenge). :param credential_password: The password used to protect access to the credential. :param card_crypto: The card cryptogram. )rArr7r)r`rer)r)rArr7rrr! calculate_session_keys_symmetricZ/HsmAuthSession.calculate_session_keys_symmetricvs6    ( ($7' )   r#c s0V^8dQhRRRRRRRRR RR R /#) rrAr;rr9rrr7r8rrr`rrr r!r"rksF& & & & . & ) &  &  & r#c  s\VPR4\VP\P 4'g \ R4hVP4p\P!R^4\PVPVP^,R4,\PVPVP^,R4,p\P!VP#VVVVVR74#)aSCalculate session keys from an asymmetric YubiHSM Auth credential. :param label: The label of the credential. :param context: The context (EPK.OCE + EPK.SD). :param public_key: The YubiHSM device's public key. :param credential_password: The password used to protect access to the credential. :param card_crypto: The card cryptogram. rz!BZbig)rArr7rrr)rror:rr rr'Zpublic_numbersstructZpackrZto_bytesZxZkey_sizeZyr`rer)r)rArrr7rrZpublic_key_datarr!!calculate_session_keys_asymmetricZ0HsmAuthSession.calculate_session_keys_asymmetrics$  i0***BLL9901 1++- KKa ll799j&9&9Q&>F Gll799j&9&9Q&>F G     ( ($7'* )   r#crg)rrAr;r7zbytes | str | Nonerr9rrr r!r"rks)III/AI Ir#c s@\VPR4\\\ V44pVeJVPR8gVP^,^8Xd!V\\ \ V44, pVPP^\^^V4#)a4Get the Host Challenge. For symmetric credentials this is Host Challenge, a random 8 byte value. For asymmetric credentials this is EPK-OCE. :param label: The label of the credential. :param credential_password: The password used to protect access to the credential, needed for asymmetric credentials. r)rii) rror rrDrr@rlrpINS_GET_CHALLENGE)r)rAr7rIs&&& r! get_challengeZHsmAuthSession.get_challenges  i0)\%%89  * LLI %aA)= C')CDW)X D}}&&q*;Q4HHr#)rmrlrE)F)NN)r-r.r/r0r1rnr4rortrxrrrrrrrrrrrrrrrrr5rr#r!rfrfs6 3E 2Sh! F 0! F : Q8,6056!F D 2& PIIr#rf)NZ __future__rZloggingrZ dataclassesrZenumrrZ functoolsrZtypingrZcryptography.hazmat.backendsrZcryptography.hazmat.primitivesrZ)cryptography.hazmat.primitives.asymmetricr Z)cryptography.hazmat.primitives.kdf.pbkdf2r Zcorer r r rrrrZcore.smartcardrrrrrrZ getLoggerr-rrrrvrrrrrrrGrrrrrrrrrurqZINS_GET_VERSIONrrrrr~r=rBrCZDEFAULT_MANAGEMENT_KEYrrr@rDrJrTrVrWr`rfrr#r!rsw8# ! $818@   8 $                !%!%  H(  $ $  t$  % ( * (oIoIr#