OpenPGP Commands
Acronyms and their definitions are listed at the bottom of the Base Commands page.
ykman openpgp [OPTIONS] COMMAND [ARGS]…
Description: | Manage OpenPGP Application. |
---|
Examples
Set the retries for PIN, Reset Code and Admin PIN to 10:
$ ykman openpgp set-retries 10 10 10
Require touch to use the authentication key:
$ ykman openpgp set-touch aut on
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
Commands
Command | Description |
---|---|
access |
Manage PIN, Reset Code, and Admin PIN. |
certificates |
Manage certificates. |
info |
Display general status of the OpenPGP application. |
keys |
Manage private keys. |
reset |
Reset all OpenPGP data. |
ykman openpgp access [OPTIONS] COMMAND [ARGS]…
Description: | Manage PIN, Reset Code and Admin PIN. |
---|
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
Commands
Command | Description |
---|---|
set-retries |
Set PIN, Reset Code and Admin PIN retries. |
ykman openpgp access set-retries [OPTIONS] PIN-RETRIES RESET-CODE-RETRIES ADMIN-PIN-RETRIES
Description: | Set PIN, Reset Code and Admin PIN retries. |
---|
Arguments
Argument | Description |
---|---|
PIN-RETRIES |
Set number of retries for PIN attempts. |
RESET-CODE-RETRIES |
Set number of retries for RESET CODE attempts. |
ADMIN-PIN-RETRIES |
Set number of retries for ADMIN PIN attempts. |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-a, --admin-pin TEXT |
Admin PIN for OpenPGP. |
-f, --force |
Confirm the action without prompting. |
ykman openpgp certificates [OPTIONS] COMMAND [ARGS]…
Description: | Manage certificates. |
---|
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
Commands
Command | Description |
---|---|
delete |
Delete an OpenPGP certificate. |
export |
Export an OpenPGP certificate. |
import |
Import an OpenPGP certificate. |
ykman openpgp certificates delete [OPTIONS] KEY
Description: | Delete an OpenPGP certificate. |
---|
Arguments
Argument | Description |
---|---|
KEY |
Key slot to delete certificate from
sig , enc ,aut , or att |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-a, --admin-pin TEXT |
Admin PIN for OpenPGP. |
ykman openpgp certificates export [OPTIONS] KEY CERTIFICATE
Description: | Export an OpenPGP certificate. |
---|
Arguments
Argument | Description |
---|---|
CERTIFICATE |
File to write certificate to. Use
'-' to usestdout . |
KEY |
Key slot to read from (
sig , enc , aut ,or
att ). |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-F, --format [PEM|DER] |
Encoding format. [Default: PEM ] |
ykman openpgp certificates import [OPTIONS] KEY CERTIFICATE
Description: | Import an OpenPGP certificate. |
---|
Arguments
Argument | Description |
---|---|
CERTIFICATE |
File containing the certificate. Use
'-' touse
stdin . |
KEY |
Key slot to import certificate to (
sig , enc ,aut , or att ). |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-a, --admin-pin TEXT |
Admin PIN for OpenPGP. |
ykman openpgp keys [OPTIONS] COMMAND [ARGS]…
Description: | Manage private keys. |
---|
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
Commands
Command | Description |
---|---|
attest |
Generate an attestation certificate for a key. |
import |
Import a private key (ONLY SUPPORTS ATTESTATION KEY). |
set-touch |
Set touch policy for OpenPGP keys. |
ykman openpgp keys attest [OPTIONS] KEY CERTIFICATE
Description: | Generate an attestation certificate for a key. Attestation is used to show that an asymmetric key was generated on the YubiKey and therefore doesn’t exist outside the device. |
---|
Arguments
Argument | Description |
---|---|
KEY |
Key slot to attest (sig , enc , aut ). |
CERTIFICATE |
File to write attestation certificate to. Use
'-' touse
stdout . |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-F, --format [PEM|DER] |
Encoding format. [Default: PEM ] |
-P, --pin TEXT |
PIN code. |
ykman openpgp keys import [OPTIONS] KEY PRIVATE-KEY
Description: | Import a private key (ONLY SUPPORTS ATTESTATION KEY). Import a private key for OpenPGP attestation. |
---|
Arguments
Argument | Description |
---|---|
KEY |
Key slot to import (sig , enc , aut ). |
PRIVATE-KEY |
File containing the private key. Use
'-' touse
stdin . |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-a, --admin-pin TEXT |
Admin PIN for OpenPGP. |
ykman openpgp keys set-touch [OPTIONS] KEY POLICY
Description: | Set touch policy for OpenPGP keys. |
---|
Arguments
Argument | Description |
---|---|
KEY |
Key slot to set (sig , enc , aut or att ). |
POLICY |
Touch policy to set (on , off , fixed , cached
or cached-fixed ). |
The touch policy is used to require user interaction for all operations using the private key on the YubiKey. The touch policy is set individually for each key slot. To see the current touch policy, run:
$ ykman openpgp info
Touch Policies
Policy | Description |
---|---|
Cached |
Touch required, cached for 15s after use. |
Cached-Fixed |
Touch required, cached for 15s after use, can’t be
disabled without a full reset.
|
Fixed |
Touch required, can’t be disabled without a full reset. |
Off |
No touch required. (default) |
On |
Touch required. |
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-a, --admin-pin TEXT |
Admin PIN for OpenPGP. |
-f, --force |
Confirm the action without prompting. |
ykman openpgp info [OPTIONS]
Description: | Display status of OpenPGP application. |
---|
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
ykman openpgp reset [OPTIONS]
Description: | Reset OpenPGP application. This action wipes all OpenPGP data, and sets all PINs to their default values. |
---|
Options
Option | Description |
---|---|
-h, --help |
Show this message and exit. |
-f, --force |
Confirm the action without prompting. |
To get in touch with Yubico Support, go to https://support.yubico.com/hc/en-us/requests/new.
To get in touch with Yubico Support, click here.