YubiKey Provisioning

To provision or re-provision your keys for the HSM either use “Yubico Authenticator APP” to provision a key

  • Start the application, insert the key.

  • Select “Slot 1” (Short touch)

  • Select “Yubico OTP”

  • Either choose your public ID (MODHEX) or klick the icon to base if from the key serial

  • Generate random “Private ID” and “Secret key”

  • Make sure the “Append enter” is checked

  • Select a output file

  • Save (OBS! this operation will overwrite existing slot)

OR

If you want to program multiple keys similar to how the old tool used to work then we have writen a python wrapper for the CLI tool “ykman”

usage: ykbatch.py [-h] [--slot {1,2}] [--start-public-id MODHEX] [--continuous] [--no-enter] [--apply] [--poll-seconds POLL_SECONDS] [--output OUTPUT]

Program randomized YubiOTP credentials.

optional arguments:
  -h, --help                 show this help message and exit
  --slot {1,2}
  --start-public-id MODHEX   first 12-character public ID; increment after each successful key
  --continuous               wait for keys one at a time
  --no-enter                 do not append Enter to OTP output
  --apply                    program the key (default: dry-run)
  --poll-seconds POLL_SECONDS
  --output OUTPUT            single ykksm output file (default: yubiotp-credentials.csv)

This would look like this for example:

% python3 ykbatch.py --start-public-id cvdftlntitbv --continuous --apply
WRITE mode enabled. Type APPLY to continue: APPLY

YubiKey 1308699
  ykman --device 1308699 otp yubiotp 1 --generate-private-id --generate-key --config-output yubiotp-credentials.csv --enter --force --public-id cvdftlntitbv
  Configuration parameters written to yubiotp-credentials.csv.
  Result: OK; credential appended to yubiotp-credentials.csv
  Remove this YubiKey before inserting the next one.
Insert the next unprocessed YubiKey (Ctrl-C to finish).

YubiKey 1077665
  ykman --device 1077665 otp yubiotp 1 --generate-private-id --generate-key --config-output yubiotp-credentials.csv --enter --force --public-id cvdftlntitdc
  Configuration parameters written to yubiotp-credentials.csv.
  Result: OK; credential appended to yubiotp-credentials.csv
  Remove this YubiKey before inserting the next one.
Insert the next unprocessed YubiKey (Ctrl-C to finish).
^C
Finished.

% cat yubiotp-credentials.csv
# ykksm 1
1308699,cvdftlntitbv,8a3abfbc591d,779cd1563d80fba92ecff35c92918724,,2026-08-20T12:40:10,
1077665,cvdftlntitdc,946d58a45729,5068cbe1fcd98e36e54ca50812c50745,,2026-08-20T12:40:20,

(OLD still works but tool depricated)

Use the Yubikey Personalization Tool to create the keys.

  • Select “Yubico OTP”

  • Select “Advanced”

  • Check “Configuration Slot 1”

  • Check “Program Multiple Keys”

  • Check “Automatically program Yubikeys when inserted”

  • From the Drop down menu select “Increment Identity; Randomize secrets”

  • Click Generate for “Public Identity”, “Private Identity” and “Secret Key”

Insert a Key and provision it, you will get a question where to store the logfile, choose an appropriate place and keep inserting and removing the keys watching that the number correspond too your expected number of keys.

Once done with all keys you will have a log file looking to something similar to:

Yubico OTP,2020-10-16 -  11:26,1,rhbrtubrlkjc,9ace257569c7,fd21ea4f99151eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
Yubico OTP,2020-10-16 -  11:26,1,rhbrtubrlkjd,9ace257569c7,fd21ea4f99251eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
Yubico OTP,2020-10-16 -  11:26,1,rhbrtubrlkje,9ace257569c7,fd21ea4f99351eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
Yubico OTP,2020-10-16 -  11:26,1,rhbrtubrlkjf,9ace257569c7,fd21ea4f99451eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
...

Trim this file to remove everything prior to the 1, so it resembles the below format.

1,rhbrtubrlkjc,9ace257569c7,fd21ea4f99151eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
1,rhbrtubrlkjd,9ace257569c7,fd21ea4f99251eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
1,rhbrtubrlkje,9ace257569c7,fd21ea4f99351eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
1,rhbrtubrlkjf,9ace257569c7,fd21ea4f99451eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0

Then add a first line containing # ykksm 1, so the result looks like:

# ykksm 1
1,rhbrtubrlkjc,9ace257569c7,fd21ea4f99151eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
1,rhbrtubrlkjd,9ace257569c7,fd21ea4f99251eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
1,rhbrtubrlkje,9ace257569c7,fd21ea4f99351eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0
1,rhbrtubrlkjf,9ace257569c7,fd21ea4f99451eefff8ad82274d9ff6c,,,0,0,0,0,0,0,0,0,0,0

Then this file is ready for provisioning into the HSM, using the menu option Manage the YubiHSM settings

Note

Ensure the resulting file only has linefeeds (LF, ASCII code 10) as line termination.