This file holds data used in the Yubikey personalization phase.
The file is an OpenPGP signed and encrypted text file. Readers should support both CRLF and LF line endings. The values are text and separated by comma ("," ASCII 0x2C). The first line of the file MUST be as follows:
ykksm 1
Each of the rest lines in the file follows the following format:
serialNr,publicName,internalName,aesKey,lockCode,created,accessed[,progflags] # comment
Any data after a # is treated as a comment and is ignored. Lines of the following format:
comment
are also treated as comments.
The meaning are as follows:
|
serialNr
|
the serial number of the device used for the barcode, decimal integer |
|
publicName
|
encoding of the "external" yubikey prefix, 0-16 modhex characters, typically 12 modhex encoded data |
|
internalName
|
encoding of the "internal" yubikey identity, always 6 binary bytes = 12 hex, hex encoded data |
|
aesKey
|
an aes key used for the device, length decides whether it is a 128, 192, or 256 bit keys. hex encoded data |
|
lockCode
|
the locking code, always 6 binary bytes = 12 hex, hex encoded data |
|
created
|
timestamp of when the key was created for example 2009-02-24T17:41:57 or empty |
|
accessed
|
timestamp of when the key was last accessed for example 2009-02-24T17:41:57 or empty |
|
progflags
|
optional field, integer with flags used during personalization to enable, e.g., static key mode or cr output |
Examples of valid data lines:
4711,dlcfffckrcde,ca62baca62ba,ecde18dbe76fbd0c33330f1c354871db,be70aeca62ba,2009-01-22 00:25:11, 4712,,ca62baca62ba,ecde18dbe76fbd0c33330f1c354871db,be70aeca62ba,2009-01-22 00:25:11,2009-02-13 00:05:40 4713,dlcfffckrcdedlcf,ca62baca62ba,ecde18dbe76fbd0c33330f1c354871db,be70aeca62ba,2009-01-22 00:25:11,2009-02-13 00:05:40,0 4714,dlcfffckrcdedlcf,ca62baca62ba,ecde18dbe76fbd0c33330f1c354871db,be70aeca62ba,2009-01-22 00:25:11,2009-02-13 00:05:40,4711
Example of actual data using the password foobar (normally it would be encrypted to a particular OpenPGP key id):
-----BEGIN PGP MESSAGE----- Version: GnuPG v1.4.9 (GNU/Linux) jA0EAwMClfljrWYVfm5gycDMIpZXLnzKtUfeEsqXRp63IdAghBzAfdIt4aeJ2kdV x8uvvHKeHfytjEo/U9Wg4NYqYoDnMeb4zXBmrRqWu558ldW75e5R2kPImuQnZIBQ 3WKRbElrLpQTlbdyDDAzlOnVLvTrmekZ8ByUrED3tyZKJw7OW5YsHi3z5N+QNFbZ hpMWfDBiJRksQEXv3BbiWVojSS+ZlCBiDjqnbIGuk0nZlJSe3F3Jwdz22Y05aU2h +2e6vWkqsbvZMVHnU6pauyaM1dh2owXsoHCPLM1fs7ztIh5dAnV9d0TuW4ufKEFQ FdH5c4dNgl36CNM8dDlM3c8YpfjxlQ11e6ub7QZC1Eu3gqvfPIvYpczlwjkYOkcH nu1Iq42VgUSJzBr36aL9lLySyT8WRizzmJLaGYX/YqKgBXt6RTSO984WsxE6cl80 paFvFOjybJ2V5GYc7pfdZAM2ySEhnS6PaxYAQXfrEhhtTTCCg1eCqKh4Yamv3u0v DAkppMqXeprjpC4cNvrQsVOKGx7HissA5x4rECLC =d54w -----END PGP MESSAGE-----
The files should use the standard GnuPG output extension .asc.
If you want to store many keys in a one-key per file approach, we suggest to create files named after the serial number. For example:
0.asc 1.asc 2.asc 3.asc 4.asc 5.asc 6.asc 7.asc 8.asc 9.asc 10.asc 11.asc ...