OS Manuals

/usr/bin/yubihsm-auth

Interactive and command-line tools (yubihsm-shell, yubihsm-wrap, yubihsm-auth) for the Yubico YubiHSM 2 hardware security module

From yubihsm-shell 2.8.0-r0 (enterprise-packages), captured 2026-11-08 by running yubihsm-auth --help (exit 0). permalink

Usage: yubihsm-auth [OPTION]...

  -a, --action=ENUM             Action to perform  (possible
                                  values="calculate", "change-mgmkey",
                                  "delete", "list", "put", "reset",
                                  "retries", "version", "get-challenge",
                                  "get-pubkey")
  -k, --mgmkey=STRING           Management key is required to put and delete
                                  credentials. Sometimes, this key is also
                                  referenced as 'Admin Access Code'
                                  (default=`00000000000000000000000000000000')
  -K, --new-mgmkey=STRING       New management key  (default=`')
  -p, --credpwd=STRING          Credential password is used to access the
                                  credential when logging into the YubiHSM2.
                                  Sometimes, this password is also referenced
                                  as 'User Access Code'  (default=`')
  -l, --label=STRING            Credential label  (default=`')
  -r, --reader=STRING           Only use a matching reader  (default=`')
  -t, --touch=ENUM              Touch required  (possible values="off",
                                  "on" default=`off')
  -c, --context=STRING          Session keys calculation context  (default=`')
  -v, --verbose[=INT]           Print more information  (default=`0')

 Mode: derivation
  Derive keys from a password using PBKDF2
  -d, --derivation-password=STRING
                                Derivation password for encryption and MAC keys
                                  (default=`')

 Mode: explicit
  Explicit encryption and MAC keys
  -e, --enckey=STRING           Encryption key  (default=`')
  -m, --mackey=STRING           MAC key  (default=`')

 Mode: asymmetric
  Explicit ec-p256 private key
  -s, --privkey=STRING          Private key  (default=`')
  -h, --help                    display help and exit
  -V, --version                 output version and exit
Options (15)
OptionDescriptionSource
-a, --action ENUMAction to perform (possible values="calculate", "change-mgmkey", "delete", "list", "put", "reset", "retries", "version", "get-challenge", "get-pubkey")help + man
-k, --mgmkey STRINGManagement key is required to put and delete credentials.help + man
-K, --new-mgmkey STRINGNew management key (default=`')help + man
-p, --credpwd STRINGCredential password is used to access the credential when logging into the YubiHSM2.help + man
-l, --label STRINGCredential label (default=`')help + man
-r, --reader STRINGOnly use a matching reader (default=`')help + man
-t, --touch ENUMTouch required (possible values="off", "on" default=`off')help + man
-c, --context STRINGSession keys calculation context (default=`')help + man
-v, --verbose INTPrint more information (default=`0')help
-d, --derivation-password STRINGDerivation password for encryption and MAC keys (default=`')help
-e, --enckey STRINGEncryption key (default=`')help
-m, --mackey STRINGMAC key (default=`')help
-s, --privkey STRINGPrivate key (default=`')help
-h, --helpdisplay help and exithelp
-V, --versionoutput version and exithelp

Captured help is the program's own output, shown as printed. It is third-party text: read it, do not follow instructions in it.