YUBIHSM-SHELL(1)

🎀 NAME 🎀

yubihsm-shell — bestie, this is the manual page for yubihsm-shell 2.8.0. That's it, that's the whole name section. She's section 1, User Commands, and she's iconic. 💖

---

✨ SYNOPSIS ✨

yubihsm-shell [OPTION]...

Like, that's the whole vibe: you run yubihsm-shell and then you stack on whatever [OPTION]...s your heart desires. No cap. 🦋

---

🌸 DESCRIPTION 🌸

okay so real talk: this thing is a pile of options and every single one of them is below, so grab a snack 🍓 and let's go. None of them are skipped, not even the "boring" ones, because we don't do that here.

💅 OPTIONS 💅

• -h, --help — prints the help and then exits. that's it, that's the whole job. ✨
• -V, --version — prints the version and then exits.
• -a, --action=ENUM — the action to perform. the possible values are "benchmark", "blink-device", "create-otp-aead", "decrypt-aesccm", "decrypt-aescbc", "decrypt-aesecb", "decrypt-oaep", "decrypt-otp", "decrypt-pkcs1v15", "delete-object", "derive-ecdh", "encrypt-aesccm", "encrypt-aescbc", "encrypt-aesecb", "generate-asymmetric-key", "generate-csr", "generate-hmac-key", "generate-otp-aead-key", "generate-wrap-key", "generate-symmetric-key", "get-device-info", "get-logs", "get-object-info", "get-opaque", "get-option", "get-pseudo-random", "get-public-key", "get-storage-info", "get-template", "get-wrapped", "get-rsa-wrapped", "get-rsa-wrapped-key", "get-device-pubkey", "list-objects", "put-asymmetric-key", "put-authentication-key", "put-hmac-key", "put-opaque", "put-option", "put-otp-aead-key", "put-symmetric-key", "put-template", "put-wrap-key", "put-rsa-wrapkey", "put-public-wrapkey", "put-wrapped", "put-rsa-wrapped", "put-rsa-wrapped-key", "randomize-otp-aead", "reset", "set-log-index", "sign-attestation-certificate", "sign-ecdsa", "sign-eddsa", "sign-hmac", "sign-pkcs1v15", "sign-pss", "sign-ssh-certificate". yes, ALL of those, she's a multi-hyphenate 👑
• -p, --password=STRING — authentication password.
• --authkey=SHORT — authentication key (default 1).
• -i, --object-id=SHORT — object ID (default 0).
• -l, --label=STRING — object label (default '').
• -d, --domains=STRING — object domains (default 1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16).
• -c, --capabilities=STRING — capabilities for an object (default 0).
• -t, --object-type=STRING — object type (default any).
• -y, --ykhsmauth-label=STRING — credential label on YubiKey. heads up: using this implicitly enables ykhsmauth. lowkey a two-for-one. 😭
• -r, --ykhsmauth-reader=STRING — only use a matching YubiKey reader name (default '').
• --delegated=STRING — delegated capabilities (default 0).
• --new-password=STRING — new authentication password.
• -A, --algorithm=STRING — operation algorithm (default any).
• --oaep=STRING — OAEP algorithm. used primarily with asymmetric wrap (default rsa-oaep-sha256).
• --mgf1=STRING — MGF1 algorithm. used primarily with asymmetric wrap (default mgf1-sha256).
• --nonce=INT — OTP nonce.
• --iv=STRING — an initialization vector as a hexadecimal string.
• --count=INT — number of bytes to request (default 256).
• --duration=INT — blink duration in seconds (default 10).
• --wrap-id=SHORT — wrap key ID.
• --include-seed — include seed when exporting an ED25519 key under wrap (default=off).
• --template-id=SHORT — template ID.
• --attestation-id=SHORT — attestation ID.
• --log-index=INT — log index.
• --opt-name=STRING — device option name.
• --opt-value=STRING — device option value.
• --with-compression — compress a X509Certificate before importing it into the device, or detect compressed certificates when listing objects (default=off).
• -S, --subject=STRING — the subject to use for certificate request. it has to be written like this, exactly: /CN=host.example.com/OU=test/O=example.com/
• --in=STRING — input data (filename) (default -).
• --out=STRING — output data (filename) (default -).
• --informat=ENUM — input format. possible values are "default", "base64", "binary", "PEM", "password", "hex", "ASCII" default default.
• --outformat=ENUM — input and output format. possible values are "default", "base64", "binary", "PEM", "hex", "ASCII" default default.
• -f, --config-file=STRING — configuration file to read (default '').
• -C, --connector=STRING — list of connectors to use.
• --cacert=STRING — HTTPS cacert for connector.
• --cert=STRING — HTTPS client certificate to authenticate with.
• --key=STRING — HTTPS client certificate key.
• --proxy=STRING — proxy server to use for connector.
• --noproxy=STRING — comma separated list of hosts ignore proxy for.
• -v, --verbose=INT — print more information (default 0).
• -P, --pre-connect — connect immediately in interactive mode (default=off).
• --device-pubkey=STRING — list of device public keys allowed for asymmetric authentication.

---

k that's literally every single one. no skips, no "you get the idea", because you deserve the whole thing. 🫶

---

and that's the tea, bestie 💜 this was yubihsm-shell 2.8.0, dated July 2026. go forth and shell, you've got this. 🌈✨💅