YUBIHSM-AUTH(1) User Commands YUBIHSM-AUTH(1)

# [NAME](#NAME)

yubihsm-auth - manual page for yubihsm-auth 2.8.0

# [SYNOPSIS](#SYNOPSIS)

**yubihsm-auth** \[*OPTION*]...

# [DESCRIPTION](#DESCRIPTION)

[**-a**, **--action**=*ENUM*](#a)

Action to perform (possible values="calculate", "change-mgmkey", "delete", "list", "put", "reset", "retries", "version", "get-challenge", "get-pubkey")

[**-k**, **--mgmkey**=*STRING*](#k)

Management key is required to put and delete credentials. Sometimes, this key is also referenced as 'Admin Access Code' (default=\`00000000000000000000000000000000')

[**-K**, **--new-mgmkey**=*STRING*](#K)

New management key (default=\`')

[**-p**, **--credpwd**=*STRING*](#p)

Credential password is used to access the credential when logging into the YubiHSM2. Sometimes, this password is also referenced as 'User Access Code' (default=\`')

[**-l**, **--label**=*STRING*](#l)

Credential label (default=\`')

[**-r**, **--reader**=*STRING*](#r)

Only use a matching reader (default=\`')

[**-t**, **--touch**=*ENUM*](#t)

Touch required (possible values="off", "on" default=\`off')

[**-c**, **--context**=*STRING*](#c)

Session keys calculation context (default=\`')

[**-v**, **--verbose**\[=*INT*\]](#v)

Print more information (default=\`0')

Mode: derivation

Derive keys from a password using PBKDF2 **-d**, **--derivation-password**=*STRING*

[Derivation password for encryption and MAC keys](#Derivation)

(default=\`')

Mode: explicit

Explicit encryption and MAC keys **-e**, **--enckey**=*STRING* Encryption key (default=\`') **-m**, **--mackey**=*STRING* MAC key (default=\`')

Mode: asymmetric

Explicit ec-p256 private key **-s**, **--privkey**=*STRING* Private key (default=\`') **-h**, **--help** display help and exit **-V**, **--version** output version and exit

October 2026 yubihsm-auth 2.8.0

---

Document: yubihsm-auth(1) from yubihsm-shell 2.8.0-r0 (Chainguard OS)