YKCHALRESP(1)

YKCHALRESP(1) 💅 — aka ykchalresp, from the YubiKey Personalization Tool, section M of the manual

okay bestie, sit down, hydrate, because we're about to talk to a tiny USB stick and make it do math 🔥

✨ NAME ✨

ykchalresp — Perform challenge-response operation with YubiKey

🌸 SYNOPSIS 🌸

ykchalresp [-nkey] [-1 | -2] [-H | -Y] [-N] [-x] [-v] [-6 | -8] [-t]
[-iFILE] [-V] [-h]

🦋 DESCRIPTION 🦋

So basically 💖 you send a challenge to a YubiKey, and then you read the response back. That's it, that's the whole vibe. The YubiKey can be configured with two different C/R modes — the standard one is a 160 bits HMAC-SHA1, and the other one is a YubiKey OTP mimicking mode. And with that second mode, the way it works is that two subsequent calls with the same challenge will result in different responses 👀 (yes, that's on purpose, that's the whole point, don't @ me).

👑 OPTIONS 👑

• -nkey — send the challenge to the nth key found. key number n, bestie, not a key you type.
• -1 — send the challenge to slot 1. This is the default 💅
• -2 — send the challenge to slot 2.
• -H — send a 64 byte HMAC challenge. This is the default.
• -Y — send a 6 byte Yubico OTP challenge.
• -N — non-blocking mode — abort if the YubiKey is configured to require a key press before sending the response. like, it will NOT wait around for you to tap it, it has places to be 🙈
• -x — challenge is hex encoded.
• -v — enable verbose mode.
• -6 — output the response in OATH format, 6 digits.
• -8 — output the response in OATH format, 8 digits.
• -t — use current time as challenge instead of reading challenge from command line (as in default TOTP mode, seconds since 1970-01-01 00:00:00 / 30 encoded as an 8 byte challenge). clock-based challenge, iconic ⏰
• -iFILE — take challenge from FILE instead of as an argument. If file is - challenge is read from STDIN.
• -V — print tool version and exit.
• -h — (it's in the synopsis, bestie, I'm just reporting what I see 🫶)

🎀 EXAMPLE 🎀

The YubiKey challenge-response operation can be demonstrated using the NIST PUB 198 A.2 test vector. science!! 🧪

First, program a YubiKey with the test vector :

$ ykpersonalize -2 -ochal-resp -ochal-hmac -ohmac-lt64 -a303132333435363738393a3b3c3d3e3f40414243
 ...
Commit? (y/n) [n]: y
$

Now, send the NIST test challenge to the YubiKey and verify the result matches the expected :

$ ykchalresp -2 'Sample #2'
0922d3405faa3d194f82a45830737d5cc6c75d24
$

look at that hex string go 😭 it ATE and left no crumbs.

💀 BUGS 💀

Report ykchalresp bugs in the issue tracker https://github.com/Yubico/yubikey-personalization/issues

🌈 SEE ALSO 🌈

The ykpersonalize home page https://developers.yubico.com/yubikey-personalization/

YubiKeys can be obtained from Yubico http://www.yubico.com/

lowkey a whole journey, highkey worth it 💜

k that's the whole page bestie, go forth and challenge-response responsibly. this was ykchalresp, Version 1.19.1, dated like the YKCHALRESP(1) footer says — mwah, periodt ✨🎀🦋