How to use the command 'ykman fido' (with examples)
This article will provide examples of different use cases for the command ‘ykman fido’.
Description
The ‘ykman fido’ command is used to manage YubiKey FIDO applications. It allows users to perform various operations such as retrieving information about the FIDO2 application, changing the FIDO pin, listing resident credentials stored on the YubiKey, managing fingerprints (if the YubiKey has a fingerprint sensor), and wiping all FIDO credentials.
Use case 1: Display general information about the FIDO2 application
Code:
ykman fido info
Motivation: A user may want to retrieve general information about the FIDO2 application on their YubiKey. This information can include the application version, PIN policies, and other relevant details.
Explanation: The ‘info’ argument is used with the ‘ykman fido’ command to display general information about the FIDO2 application.
Example output:
Application version: 1.2.3
PIN policies: min_length=8, max_length=64, retry_count=3
...
Use case 2: Change the FIDO pin
Code:
ykman fido access change-pin
Motivation: If a user wants to change their FIDO pin for security reasons or to update an existing pin, they can use this command.
Explanation: The ‘change-pin’ argument is used with the ‘ykman fido access’ command to change the FIDO pin. This allows users to set a new pin for accessing the FIDO2 application on their YubiKey.
Example output:
Enter current PIN:
Enter new PIN:
Confirm new PIN:
Use case 3: List resident credentials stored on the YubiKey
Code:
ykman fido credentials list
Motivation: Users may want to view the list of resident credentials stored on their YubiKey. This can help in managing and organizing the credentials.
Explanation: The ’list’ argument is used with the ‘ykman fido credentials’ command to retrieve a list of all resident credentials stored on the YubiKey.
Example output:
Credential ID Relying Party User
---------------------------------------------------------
1234567890 example.com alice@example.com
0987654321 example.org bob@example.org
...
Use case 4: Delete a resident credential from the YubiKey
Code:
ykman fido credentials delete id
Motivation: If a user wants to remove a specific resident credential from their YubiKey, they can use this command.
Explanation: The ‘delete’ argument is used with the ‘ykman fido credentials’ command to delete a specific resident credential from the YubiKey. The ‘id’ argument should be replaced with the actual credential ID.
Example output:
Are you sure you want to delete the credential with ID 1234567890? [y/n]
Use case 5: List fingerprints stored on the YubiKey
Code:
ykman fido fingerprints list
Motivation: Users who have a YubiKey with a fingerprint sensor may want to view the list of fingerprints stored on the device. This can help in managing and organizing the stored fingerprints.
Explanation: The ’list’ argument is used with the ‘ykman fido fingerprints’ command to retrieve a list of all fingerprints stored on the YubiKey.
Example output:
Name Credential ID
---------------------------
Alice 1234567890
Bob 0987654321
...
Use case 6: Add a new fingerprint to the YubiKey
Code:
ykman fido fingerprints add name
Motivation: Users who have a YubiKey with a fingerprint sensor may want to add a new fingerprint. This is useful for authentication purposes as the YubiKey can then recognize the added fingerprint.
Explanation: The ‘add’ argument is used with the ‘ykman fido fingerprints’ command to add a new fingerprint to the YubiKey. The ’name’ argument should be replaced with a name for the fingerprint.
Example output:
Scan your fingerprint...
Fingerprint successfully added.
Use case 7: Delete a fingerprint from the YubiKey
Code:
ykman fido fingerprints delete name
Motivation: If a user wants to remove a specific fingerprint from their YubiKey, they can use this command.
Explanation: The ‘delete’ argument is used with the ‘ykman fido fingerprints’ command to delete a specific fingerprint from the YubiKey. The ’name’ argument should be replaced with the name of the fingerprint.
Example output:
Are you sure you want to delete the fingerprint with name Alice? [y/n]
Use case 8: Wipe all FIDO credentials
Code:
ykman fido reset
Motivation: In case a user exceeds the number of PIN retry attempts, they might need to wipe all FIDO credentials stored on the YubiKey. This command allows them to do so.
Explanation: The ‘reset’ argument is used with the ‘ykman fido’ command to wipe all FIDO credentials stored on the YubiKey. This action should be taken after exceeding the number of PIN retry attempts.
Example output:
Are you sure you want to wipe all FIDO credentials? [y/n]
Conclusion
The ‘ykman fido’ command provides a range of functionalities for managing YubiKey FIDO applications. Users can retrieve information about the FIDO2 application, change the FIDO pin, manage resident credentials and fingerprints, and even wipe all FIDO credentials if required. These examples demonstrate some of the common use cases of this command and how it can be used to interact with the YubiKey FIDO applications.
