1YUBICO-PIV-TOOL(1)               User Commands              YUBICO-PIV-TOOL(1)
2
3
4

NAME

6       yubico-piv-tool - Tool for managing Personal Identity Verification cre‐
7       dentials on Yubikeys
8

SYNOPSIS

10       yubico-piv-tool [OPTION]...
11

DESCRIPTION

13       -h, --help
14              Print help and exit
15
16       --full-help
17              Print help, including hidden options, and exit
18
19       -V, --version
20              Print version and exit
21
22       -v, --verbose[=INT]
23              Print more information  (default=`0')
24
25       -r, --reader=STRING
26              Only use a matching reader  (default=`Yubikey')
27
28       -k, --key[=STRING]
29              Management key to use, if no value  is  specified  key  will  be
30              asked                          for                          (de‐
31              fault=`010203040506070801020304050607080102030405060708')
32
33       -a, --action=ENUM
34              Action  to   take    (possible   values="version",   "generate",
35              "set-mgm-key",   "reset",   "pin-retries",   "import-key",  "im‐
36              port-certificate",  "set-chuid",  "request-certificate",   "ver‐
37              ify-pin",   "change-pin",  "change-puk",  "unblock-pin",  "self‐
38              sign-certificate",   "delete-certificate",   "read-certificate",
39              "status",   "test-signature",  "test-decipher",  "list-readers",
40              "set-ccc", "write-object", "read-object", "attest")
41
42              Multiple actions may be given at once and will  be  executed  in
43              order  for example --action=verify-pin --action=request-certifi‐
44              cate
45
46       -s, --slot=ENUM
47              What key slot to operate on  (possible values="9a", "9c",  "9d",
48              "9e",  "82",  "83",  "84",  "85",  "86", "87", "88", "89", "8a",
49              "8b", "8c", "8d", "8e", "8f",  "90",  "91",  "92",  "93",  "94",
50              "95", "f9")
51
52              9a  is  for  PIV Authentication 9c is for Digital Signature (PIN
53              always checked) 9d is for Key Management 9e is for Card  Authen‐
54              tication (PIN never checked) 82-95 is for Retired Key Management
55              f9 is for Attestation
56
57       -A, --algorithm=ENUM
58              What algorithm to use   (possible  values="RSA1024",  "RSA2048",
59              "ECCP256", "ECCP384" default=`RSA2048')
60
61       -H, --hash=ENUM
62              Hash  to  use for signatures  (possible values="SHA1", "SHA256",
63              "SHA384", "SHA512" default=`SHA256')
64
65       -n, --new-key=STRING
66              New management key to use for action set-mgm-key, if omitted key
67              will be asked for
68
69       --pin-retries=INT
70              Number of retries before the pin code is blocked
71
72       --puk-retries=INT
73              Number of retries before the puk code is blocked
74
75       -i, --input=STRING
76              Filename to use as input, - for stdin  (default=`-')
77
78       -o, --output=STRING
79              Filename to use as output, - for stdout (default=`-')
80
81       -K, --key-format=ENUM
82              Format  of  the  key being read/written  (possible values="PEM",
83              "PKCS12", "GZIP", "DER", "SSH" default=`PEM')
84
85       --compress
86              Compress a large certificate  using  GZIP  before  import   (de‐
87              fault=off)
88
89       -p, --password=STRING
90              Password for decryption of private key file, if omitted password
91              will be asked for
92
93       -S, --subject=STRING
94              The subject to use for certificate request
95
96              The    subject    must    be    written    as:    /CN=host.exam‐
97              ple.com/OU=test/O=example.com/
98
99       --serial=INT
100              Serial number of the self-signed certificate
101
102       --valid-days=INT
103              Time  (in  days) until the self-signed certificate expires  (de‐
104              fault=`365')
105
106       -P, --pin=STRING
107              Pin/puk code for verification, if omitted pin/puk will be  asked
108              for
109
110       -N, --new-pin=STRING
111              New  pin/puk code for changing, if omitted pin/puk will be asked
112              for
113
114       --pin-policy=ENUM
115              Set pin policy for action generate or import-key.   Only  avail‐
116              able on YubiKey 4  (possible values="never", "once", "always")
117
118       --touch-policy=ENUM
119              Set touch policy for action generate, import-key or set-mgm-key.
120              Only available on YubiKey 4 (possible values="never",  "always",
121              "cached")
122
123       --id=INT
124              Id of object for write/read object
125
126       -f, --format=ENUM
127              Format  of  data  for write/read object  (possible values="hex",
128              "base64", "binary" default=`hex')
129
130       --attestation
131              Add attestation cross-signature  (default=off)
132
133       -m, --new-key-algo=ENUM
134              New management key  algorithm  to  use  for  action  set-mgm-key
135              (possible   values="TDES",   "AES128",  "AES192",  "AES256"  de‐
136              fault=`TDES')
137
138
139
140yubico-piv-tool 2.4.2            December 2023              YUBICO-PIV-TOOL(1)