YUBIHSM-SHELL(1)

NAME
yubihsm-shell - manual page for yubihsm-shell 2.8.0

SYNOPSIS
yubihsm-shell [OPTION]...

DESCRIPTION

-h, --help
    Print help and exit

-V, --version
    Print version and exit

-a, --action=ENUM
    Action to perform (possible values="benchmark", "blink-device", "create-otp-aead", "decrypt-aesccm", "decrypt-aescbc", "decrypt-aesecb", "decrypt-oaep", "decrypt-otp", "decrypt-pkcs1v15", "delete-object", "derive-ecdh", "encrypt-aesccm", "encrypt-aescbc", "encrypt-aesecb", "generate-asymmetric-key", "generate-csr", "generate-hmac-key", "generate-otp-aead-key", "generate-wrap-key", "generate-symmetric-key", "get-device-info", "get-logs", "get-object-info", "get-opaque", "get-option", "get-pseudo-random", "get-public-key", "get-storage-info", "get-template", "get-wrapped", "get-rsa-wrapped", "get-rsa-wrapped-key", "get-device-pubkey", "list-objects", "put-asymmetric-key", "put-authentication-key", "put-hmac-key", "put-opaque", "put-option", "put-otp-aead-key", "put-symmetric-key", "put-template", "put-wrap-key", "put-rsa-wrapkey", "put-public-wrapkey", "put-wrapped", "put-rsa-wrapped", "put-rsa-wrapped-key", "randomize-otp-aead", "reset", "set-log-index", "sign-attestation-certificate", "sign-ecdsa", "sign-eddsa", "sign-hmac", "sign-pkcs1v15", "sign-pss", "sign-ssh-certificate")

-p, --password=STRING
    Authentication password

--authkey=SHORT
    Authentication key (default=`1')

-i, --object-id=SHORT
    Object ID (default=`0')

-l, --label=STRING
    Object label (default=`')

-d, --domains=STRING
    Object domains (default=`1,2,3,4,5,6,7,8,9,10,11,12,13,14,15,16')

-c, --capabilities=STRING
    Capabilities for an object (default=`0')

-t, --object-type=STRING
    Object type (default=`any')

-y, --ykhsmauth-label=STRING
    Credential label on YubiKey (implicitly enables ykhsmauth)

-r, --ykhsmauth-reader=STRING Only use a matching YubiKey reader name
    (default=`')

--delegated=STRING
    Delegated capabilities (default=`0')

--new-password=STRING
    New authentication password

-A, --algorithm=STRING
    Operation algorithm (default=`any')

--oaep=STRING
    OAEP algorithm. Used primarily with asymmetric wrap (default=`rsa-oaep-sha256')

--mgf1=STRING
    MGF1 algorithm. Used primarily with asymmetric wrap (default=`mgf1-sha256')

--nonce=INT
    OTP nonce

--iv=STRING
    An initialization vector as a hexadecimal string

--count=INT
    Number of bytes to request (default=`256')

--duration=INT
    Blink duration in seconds (default=`10')

--wrap-id=SHORT
    Wrap key ID

--include-seed
    Include seed when exporting an ED25519 key under wrap (default=off)

--template-id=SHORT
    Template ID

--attestation-id=SHORT
    Attestation ID

--log-index=INT
    Log index

--opt-name=STRING
    Device option name

--opt-value=STRING
    Device option value

--with-compression
    Compress a X509Certificate before importing it into the device or detect compressed certificates when listing objects (default=off)

-S, --subject=STRING
    The subject to use for certificate request. The subject must be written as: /CN=host.example.com/OU=test/O=example.com/

--in=STRING
    Input data (filename) (default=`-')

--out=STRING
    Output data (filename) (default=`-')

--informat=ENUM
    Input format (possible values="default", "base64", "binary", "PEM", "password", "hex", "ASCII" default=`default')

--outformat=ENUM
    Input and output format (possible values="default", "base64", "binary", "PEM", "hex", "ASCII" default=`default')

-f, --config-file=STRING
    Configuration file to read (default=`')

-C, --connector=STRING
    List of connectors to use

--cacert=STRING
    HTTPS cacert for connector

--cert=STRING
    HTTPS client certificate to authenticate with

--key=STRING
    HTTPS client certificate key

--proxy=STRING
    Proxy server to use for connector

--noproxy=STRING
    Comma separated list of hosts ignore proxy for

-v, --verbose=INT
    Print more information (default=`0')

-P, --pre-connect
    Connect immediately in interactive mode (default=off)

--device-pubkey=STRING
    List of device public keys allowed for asymmetric authentication