YUBIHSM-AUTH(1)

📦
version 2.8.0 · 9 versions
, in arch rolling, ubuntu stonking

✨ yubihsm-auth ✨ — aka the YUBIHSM-AUTH(1) page, User Commands energy 💅

okay so bestie, before anything: this is the manual for yubihsm-auth, version 2.8.0. If you're here you're probably poking at a YubiHSM2 and you need to do auth-y things to it. It's giving "cryptographic key management but make it a group chat". Let's go 🫶

🎀 NAME 🎀

yubihsm-auth — literally the manual page for yubihsm-auth 2.8.0 💖

🌸 SYNOPSIS 🌸

yubihsm-auth [OPTION]...

that's it. that's the whole synopsis. options only, no positional drama. slay 🌈

💅 DESCRIPTION 💅

so here's the full roster of everything yubihsm-auth will listen to, and the way that these flags work is you hand it one (or a few) and it goes and does the thing. no cap, every single one is here:

  • -h, --help — prints the help and then dips out. exit stage left 👋
  • -V, --version — prints the version and then also dips out. iconic behaviour 🎀
  • -a, --action=ENUM — the action you want to perform. possible values are "calculate", "change-mgmkey", "delete", "list", "put", "reset", "retries", "version", "get-challenge", "get-pubkey" ⭐ — that's the whole menu, don't be adding extras
  • -k, --mgmkey=STRING — the management key. you need this one to put and delete credentials, so like, don't forget it. sometimes this key is also called the 'Admin Access Code' (iykyk). default is 00000000000000000000000000000000
  • -K, --new-mgmkey=STRING — new management key. default is '' (empty, bestie, literally nothing) 💀
  • -p, --credpwd=STRING — the credential password, which is what gets used to access the credential when you log into the YubiHSM2. sometimes people call this the 'User Access Code'. default is ''
  • -l, --label=STRING — credential label. default is ''
  • -r, --reader=STRING — only use a matching reader. filter that vibe check. default is ''
  • -t, --touch=ENUM — whether touch is required. possible values are "off" and "on", and the default is off 👆
  • -c, --context=STRING — the session keys calculation context. default is ''
  • -v, --verbose[=INT] — print more information. default is 0. note the [=INT] — you can optionally hand it a number, it's flexible like that 💜

🔐 Mode: derivation

derive keys from a password using PBKDF2, which is very main character of it ✨

  • -d, --derivation-password=STRING — derivation password for encryption and MAC keys. default is ''

🔑 Mode: explicit

explicit encryption and MAC keys, no derivation steps, we go direct 🧚

  • -e, --enckey=STRING — encryption key. default is ''
  • -m, --mackey=STRING — MAC key. default is ''

🦋 Mode: asymmetric

explicit ec-p256 private key time, get you a curve that can do both 💅

  • -s, --privkey=STRING — private key. default is ''
bestie reminder: those default= values with '' in them are genuinely empty strings — the page says so, not me. and the management key thing is real: put and delete need it. don't skip it and then come cry in the group chat 😭

okay that's the whole page, every flag accounted for, no crumbs left. this was yubihsm-auth version 2.8.0, dated July 2026, and yeah it's the YUBIHSM-AUTH(1) manual page. go be great with your keys, mwah 🌸💖🫶

📦 where this page comes from