How to use the command 'ykman config' (with examples)

The ‘ykman config’ command is used to enable or disable YubiKey applications. It can be used to configure applications over USB or NFC, and it provides options to enable or disable specific applications or all applications at once. This article will provide examples for each of these use cases.

Use case 1: Enable an application over USB or NFC

Code:

ykman config usb|nfc --enable otp|u2f|fido2|oath|piv|openpgp|hsmauth

Motivation: You may want to enable a specific application on your YubiKey, such as OTP (One-Time Password), U2F (Universal Second Factor), FIDO2, OATH, PIV (Personal Identity Verification), OpenPGP, or HSM (Hardware Security Module) Authentication. Enabling an application allows you to use it with your YubiKey.

Explanation:

• ykman config is the command to configure YubiKey applications.
• usb|nfc specifies whether the configuration should be applied over USB or NFC.
• --enable is used to enable applications. It can be used multiple times to specify more applications.
• otp|u2f|fido2|oath|piv|openpgp|hsmauth specifies the application(s) to enable. You can choose one or more from the provided options.

Example output:

Enabled OTP application over USB.

Use case 2: Disable an application over USB or NFC

Code:

ykman config usb|nfc --disable otp|u2f|fido2|oath|piv|openpgp|hsmauth

Motivation: You may want to disable a specific application on your YubiKey. Disabling an application prevents it from being used with your YubiKey.

Explanation:

• ykman config is the command to configure YubiKey applications.
• usb|nfc specifies whether the configuration should be applied over USB or NFC.
• --disable is used to disable applications. It can be used multiple times to specify more applications.
• otp|u2f|fido2|oath|piv|openpgp|hsmauth specifies the application(s) to disable. You can choose one or more from the provided options.

Example output:

Disabled OATH application over NFC.

Use case 3: Disable all applications over NFC

Code:

ykman config nfc --disable-all

Motivation: You may want to disable all applications on your YubiKey over NFC. This can be useful if you want to temporarily restrict the use of your YubiKey or prevent any unintended access.

Explanation:

• ykman config is the command to configure YubiKey applications.
• nfc specifies that the configuration should be applied over NFC.
• --disable-all is used to disable all applications over NFC.

Example output:

Disabled all applications over NFC.

Conclusion:

The ‘ykman config’ command provides a convenient way to enable or disable YubiKey applications over USB or NFC. With this command, you can configure your YubiKey based on your specific needs and preferences.