yubikit.openpgp

Attributes

DEFAULT_USER_PIN
DEFAULT_ADMIN_PIN
TAG_DISCRETIONARY
TAG_EXTENDED_CAPABILITIES
TAG_FINGERPRINTS
TAG_CA_FINGERPRINTS
TAG_GENERATION_TIMES
TAG_SIGNATURE_COUNTER
TAG_KEY_INFORMATION
TAG_PUBLIC_KEY
KeyInformation
Fingerprints
GenerationTimes
EcPublicKey
PublicKey
EcPrivateKey
PrivateKey

Classes

UIF	Enum where members are also (and must be) ints
PIN_POLICY	Enum where members are also (and must be) ints
INS	Enum where members are also (and must be) ints
PW	Enum where members are also (and must be) ints
DO	Enum where members are also (and must be) ints
OpenPgpAid	OpenPGP Application Identifier (AID)
EXTENDED_CAPABILITY_FLAGS	Support for integer-based Flags
CardholderRelatedData
ExtendedLengthInfo
GENERAL_FEATURE_MANAGEMENT	Support for integer-based Flags
ExtendedCapabilities
PwStatus
CRT	Control Reference Template values.
KEY_REF	Enum where members are also (and must be) ints
KEY_STATUS	Enum where members are also (and must be) ints
AlgorithmAttributes	OpenPGP key algorithm attributes.
RSA_SIZE	Enum where members are also (and must be) ints
RSA_IMPORT_FORMAT	Enum where members are also (and must be) ints
RsaAttributes	OpenPGP key algorithm attributes.
CurveOid	bytes(iterable_of_ints) -> bytes
OID	bytes(iterable_of_ints) -> bytes
EC_IMPORT_FORMAT	Enum where members are also (and must be) ints
EcAttributes	OpenPGP key algorithm attributes.
DiscretionaryDataObjects
ApplicationRelatedData	OpenPGP related data.
SecuritySupportTemplate
Kdf	Helper class that provides a standard way to create an ABC using
KdfNone	Helper class that provides a standard way to create an ABC using
HASH_ALGORITHM	Enum where members are also (and must be) ints
KdfIterSaltedS2k	Helper class that provides a standard way to create an ABC using
PrivateKeyTemplate	Helper class that provides a standard way to create an ABC using
RsaKeyTemplate	Helper class that provides a standard way to create an ABC using
RsaCrtKeyTemplate	Helper class that provides a standard way to create an ABC using
EcKeyTemplate	Helper class that provides a standard way to create an ABC using
OpenPgpSession	A session with the OpenPGP application.

Module Contents

yubikit.openpgp.DEFAULT_USER_PIN = '123456'

yubikit.openpgp.DEFAULT_ADMIN_PIN = '12345678'

class yubikit.openpgp.UIF

Bases: enum.IntEnum

Enum where members are also (and must be) ints

OFF = 0

ON = 1

FIXED = 2

CACHED = 3

CACHED_FIXED = 4

classmethod parse(encoded)

Parameters:

encoded (bytes)

__bytes__()

Return type:

bytes

property is_fixed: bool

Return type:

bool

property is_cached: bool

Return type:

bool

__str__()

Return str(self).

class yubikit.openpgp.PIN_POLICY

Bases: enum.IntEnum

Enum where members are also (and must be) ints

ALWAYS = 0

ONCE = 1

__str__()

Return str(self).

class yubikit.openpgp.INS

Bases: enum.IntEnum

Enum where members are also (and must be) ints

VERIFY = 32

CHANGE_PIN = 36

RESET_RETRY_COUNTER = 44

PSO = 42

ACTIVATE = 68

GENERATE_ASYM = 71

GET_CHALLENGE = 132

INTERNAL_AUTHENTICATE = 136

SELECT_DATA = 165

GET_DATA = 202

PUT_DATA = 218

PUT_DATA_ODD = 219

TERMINATE = 230

GET_VERSION = 241

SET_PIN_RETRIES = 242

GET_ATTESTATION = 251

yubikit.openpgp.TAG_DISCRETIONARY = 115

yubikit.openpgp.TAG_EXTENDED_CAPABILITIES = 192

yubikit.openpgp.TAG_FINGERPRINTS = 197

yubikit.openpgp.TAG_CA_FINGERPRINTS = 198

yubikit.openpgp.TAG_GENERATION_TIMES = 205

yubikit.openpgp.TAG_SIGNATURE_COUNTER = 147

yubikit.openpgp.TAG_KEY_INFORMATION = 222

yubikit.openpgp.TAG_PUBLIC_KEY = 32585

class yubikit.openpgp.PW

Bases: enum.IntEnum

Enum where members are also (and must be) ints

USER = 129

RESET = 130

ADMIN = 131

class yubikit.openpgp.DO

Bases: enum.IntEnum

Enum where members are also (and must be) ints

PRIVATE_USE_1 = 257

PRIVATE_USE_2 = 258

PRIVATE_USE_3 = 259

PRIVATE_USE_4 = 260

AID = 79

NAME = 91

LOGIN_DATA = 94

LANGUAGE = 61229

SEX = 24373

URL = 24400

HISTORICAL_BYTES = 24402

EXTENDED_LENGTH_INFO = 32614

GENERAL_FEATURE_MANAGEMENT = 32628

CARDHOLDER_RELATED_DATA = 101

APPLICATION_RELATED_DATA = 110

ALGORITHM_ATTRIBUTES_SIG = 193

ALGORITHM_ATTRIBUTES_DEC = 194

ALGORITHM_ATTRIBUTES_AUT = 195

ALGORITHM_ATTRIBUTES_ATT = 218

PW_STATUS_BYTES = 196

FINGERPRINT_SIG = 199

FINGERPRINT_DEC = 200

FINGERPRINT_AUT = 201

FINGERPRINT_ATT = 219

CA_FINGERPRINT_1 = 202

CA_FINGERPRINT_2 = 203

CA_FINGERPRINT_3 = 204

CA_FINGERPRINT_4 = 220

GENERATION_TIME_SIG = 206

GENERATION_TIME_DEC = 207

GENERATION_TIME_AUT = 208

GENERATION_TIME_ATT = 221

RESETTING_CODE = 211

UIF_SIG = 214

UIF_DEC = 215

UIF_AUT = 216

UIF_ATT = 217

SECURITY_SUPPORT_TEMPLATE = 122

CARDHOLDER_CERTIFICATE = 32545

KDF = 249

ALGORITHM_INFORMATION = 250

ATT_CERTIFICATE = 252

class yubikit.openpgp.OpenPgpAid

Bases: bytes

OpenPGP Application Identifier (AID)

The OpenPGP AID is a string of bytes identifying the OpenPGP application. It also embeds some values which are accessible though properties.

property version: tuple[int, int]

OpenPGP version (tuple of 2 integers: main version, secondary version).

Return type:

tuple[int, int]

property manufacturer: int

16-bit integer value identifying the manufacturer of the device.

This should be 6 for Yubico devices.

Return type:

int

property serial: int

The serial number of the YubiKey.

NOTE: This value is encoded in BCD. In the event of an invalid value (hex A-F) the entire 4 byte value will instead be decoded as an unsigned integer, and negated.

Return type:

int

class yubikit.openpgp.EXTENDED_CAPABILITY_FLAGS

Bases: enum.IntFlag

Support for integer-based Flags

KDF = 1

PSO_DEC_ENC_AES = 2

ALGORITHM_ATTRIBUTES_CHANGEABLE = 4

PRIVATE_USE = 8

PW_STATUS_CHANGEABLE = 16

KEY_IMPORT = 32

GET_CHALLENGE = 64

SECURE_MESSAGING = 128

class yubikit.openpgp.CardholderRelatedData

name: bytes

language: bytes

sex: int

classmethod parse(encoded)

Return type:

CardholderRelatedData

class yubikit.openpgp.ExtendedLengthInfo

request_max_bytes: int

response_max_bytes: int

classmethod parse(encoded)

Return type:

ExtendedLengthInfo

class yubikit.openpgp.GENERAL_FEATURE_MANAGEMENT

Bases: enum.IntFlag

Support for integer-based Flags

TOUCHSCREEN = 1

MICROPHONE = 2

LOUDSPEAKER = 4

LED = 8

KEYPAD = 16

BUTTON = 32

BIOMETRIC = 64

DISPLAY = 128

class yubikit.openpgp.ExtendedCapabilities

flags: EXTENDED_CAPABILITY_FLAGS

sm_algorithm: int

challenge_max_length: int

certificate_max_length: int

special_do_max_length: int

pin_block_2_format: bool

mse_command: bool

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

ExtendedCapabilities

class yubikit.openpgp.PwStatus

pin_policy_user: PIN_POLICY

max_len_user: int

max_len_reset: int

max_len_admin: int

attempts_user: int

attempts_reset: int

attempts_admin: int

get_max_len(pw)

Parameters:

pw (PW)

Return type:

int

get_attempts(pw)

Parameters:

pw (PW)

Return type:

int

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

PwStatus

class yubikit.openpgp.CRT

Bases: bytes, enum.Enum

Control Reference Template values.

SIG

DEC

AUT

ATT

class yubikit.openpgp.KEY_REF

Bases: enum.IntEnum

Enum where members are also (and must be) ints

SIG = 1

DEC = 2

AUT = 3

ATT = 129

property algorithm_attributes_do: DO

Return type:

DO

property uif_do: DO

Return type:

DO

property generation_time_do: DO

Return type:

DO

property fingerprint_do: DO

Return type:

DO

property crt: CRT

Return type:

CRT

class yubikit.openpgp.KEY_STATUS

Bases: enum.IntEnum

Enum where members are also (and must be) ints

NONE = 0

GENERATED = 1

IMPORTED = 2

yubikit.openpgp.KeyInformation

yubikit.openpgp.Fingerprints

yubikit.openpgp.GenerationTimes

yubikit.openpgp.EcPublicKey

yubikit.openpgp.PublicKey

yubikit.openpgp.EcPrivateKey

yubikit.openpgp.PrivateKey

class yubikit.openpgp.AlgorithmAttributes

Bases: abc.ABC

OpenPGP key algorithm attributes.

algorithm_id: int

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

AlgorithmAttributes

abstract __bytes__()

Return type:

bytes

class yubikit.openpgp.RSA_SIZE

Bases: enum.IntEnum

Enum where members are also (and must be) ints

RSA2048 = 2048

RSA3072 = 3072

RSA4096 = 4096

class yubikit.openpgp.RSA_IMPORT_FORMAT

Bases: enum.IntEnum

Enum where members are also (and must be) ints

STANDARD = 0

STANDARD_W_MOD = 1

CRT = 2

CRT_W_MOD = 3

class yubikit.openpgp.RsaAttributes

Bases: AlgorithmAttributes

OpenPGP key algorithm attributes.

n_len: int

e_len: int

import_format: RSA_IMPORT_FORMAT

classmethod create(n_len, import_format=RSA_IMPORT_FORMAT.STANDARD)

Parameters:

• n_len (RSA_SIZE)

• import_format (RSA_IMPORT_FORMAT)

Return type:

RsaAttributes

__bytes__()

Return type:

bytes

class yubikit.openpgp.CurveOid

Bases: bytes

bytes(iterable_of_ints) -> bytes bytes(string, encoding[, errors]) -> bytes bytes(bytes_or_buffer) -> immutable copy of bytes_or_buffer bytes(int) -> bytes object of size given by the parameter initialized with null bytes bytes() -> empty bytes object

Construct an immutable array of bytes from:

• an iterable yielding integers in range(256)

• a text string encoded using the specified encoding

• any object implementing the buffer API.

• an integer

__str__()

Return str(self).

Return type:

str

__repr__()

Return repr(self).

Return type:

str

class yubikit.openpgp.OID

Bases: CurveOid, enum.Enum

bytes(iterable_of_ints) -> bytes bytes(string, encoding[, errors]) -> bytes bytes(bytes_or_buffer) -> immutable copy of bytes_or_buffer bytes(int) -> bytes object of size given by the parameter initialized with null bytes bytes() -> empty bytes object

Construct an immutable array of bytes from:

• an iterable yielding integers in range(256)

• a text string encoded using the specified encoding

• any object implementing the buffer API.

• an integer

SECP256R1

SECP256K1

SECP384R1

SECP521R1

BrainpoolP256R1

BrainpoolP384R1

BrainpoolP512R1

X25519

Ed25519

__repr__()

Return repr(self).

Return type:

str

__str__()

Return str(self).

Return type:

str

class yubikit.openpgp.EC_IMPORT_FORMAT

Bases: enum.IntEnum

Enum where members are also (and must be) ints

STANDARD = 0

STANDARD_W_PUBKEY = 255

class yubikit.openpgp.EcAttributes

Bases: AlgorithmAttributes

OpenPGP key algorithm attributes.

oid: CurveOid

import_format: EC_IMPORT_FORMAT

classmethod create(key_ref, oid)

Parameters:

• key_ref (KEY_REF)

• oid (CurveOid)

Return type:

EcAttributes

__bytes__()

Return type:

bytes

class yubikit.openpgp.DiscretionaryDataObjects

extended_capabilities: ExtendedCapabilities

attributes_sig: AlgorithmAttributes

attributes_dec: AlgorithmAttributes

attributes_aut: AlgorithmAttributes

attributes_att: AlgorithmAttributes | None

pw_status: PwStatus

fingerprints: Fingerprints

ca_fingerprints: Fingerprints

generation_times: GenerationTimes

key_information: KeyInformation

uif_sig: UIF | None

uif_dec: UIF | None

uif_aut: UIF | None

uif_att: UIF | None

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

DiscretionaryDataObjects

get_algorithm_attributes(key_ref)

Parameters:

key_ref (KEY_REF)

Return type:

AlgorithmAttributes

get_uif(key_ref)

Parameters:

key_ref (KEY_REF)

Return type:

Optional[UIF]

class yubikit.openpgp.ApplicationRelatedData

OpenPGP related data.

aid: OpenPgpAid

historical: bytes

extended_length_info: ExtendedLengthInfo | None

general_feature_management: GENERAL_FEATURE_MANAGEMENT | None

discretionary: DiscretionaryDataObjects

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

ApplicationRelatedData

class yubikit.openpgp.SecuritySupportTemplate

signature_counter: int

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

SecuritySupportTemplate

class yubikit.openpgp.Kdf

Bases: abc.ABC

Helper class that provides a standard way to create an ABC using inheritance.

algorithm: ClassVar[int]

abstract process(pw, pin)

Run the KDF on the input PIN.

Parameters:

• pw (PW)

• pin (str)

Return type:

bytes

classmethod parse(encoded)

Parameters:

encoded (bytes)

Return type:

Kdf

abstract __bytes__()

Return type:

bytes

class yubikit.openpgp.KdfNone

Bases: Kdf

Helper class that provides a standard way to create an ABC using inheritance.

algorithm = 0

process(pw, pin)

Run the KDF on the input PIN.

__bytes__()

class yubikit.openpgp.HASH_ALGORITHM

Bases: enum.IntEnum

Enum where members are also (and must be) ints

SHA256 = 8

SHA512 = 10

create_digest()

class yubikit.openpgp.KdfIterSaltedS2k

Bases: Kdf

Helper class that provides a standard way to create an ABC using inheritance.

algorithm = 3

hash_algorithm: HASH_ALGORITHM

iteration_count: int

salt_user: bytes

salt_reset: bytes | None

salt_admin: bytes | None

initial_hash_user: bytes | None

initial_hash_admin: bytes | None

classmethod create(hash_algorithm=HASH_ALGORITHM.SHA256, iteration_count=7864320)

Parameters:

• hash_algorithm (HASH_ALGORITHM)

• iteration_count (int)

Return type:

KdfIterSaltedS2k

get_salt(pw)

Parameters:

pw (PW)

Return type:

bytes

process(pw, pin)

Run the KDF on the input PIN.

__bytes__()

class yubikit.openpgp.PrivateKeyTemplate

Bases: abc.ABC

Helper class that provides a standard way to create an ABC using inheritance.

crt: CRT

__bytes__()

Return type:

bytes

class yubikit.openpgp.RsaKeyTemplate

Bases: PrivateKeyTemplate

Helper class that provides a standard way to create an ABC using inheritance.

e: bytes

p: bytes

q: bytes

class yubikit.openpgp.RsaCrtKeyTemplate

Bases: RsaKeyTemplate

Helper class that provides a standard way to create an ABC using inheritance.

iqmp: bytes

dmp1: bytes

dmq1: bytes

n: bytes

class yubikit.openpgp.EcKeyTemplate

Bases: PrivateKeyTemplate

Helper class that provides a standard way to create an ABC using inheritance.

private_key: bytes

public_key: bytes | None

class yubikit.openpgp.OpenPgpSession(connection, scp_key_params=None)

A session with the OpenPGP application.

Parameters:

• connection (yubikit.core.smartcard.SmartCardConnection)

• scp_key_params (Optional[yubikit.core.smartcard.ScpKeyParams])

protocol

property aid: OpenPgpAid

Get the AID used to select the applet.

Return type:

OpenPgpAid

property version: yubikit.core.Version

Get the firmware version of the key.

For YubiKey NEO this is the PGP applet version.

Return type:

yubikit.core.Version

property extended_capabilities: ExtendedCapabilities

Get the Extended Capabilities from the YubiKey.

Return type:

ExtendedCapabilities

get_challenge(length)

Get random data from the YubiKey.

Parameters:

length (int) – Length of the returned data.

Return type:

bytes

get_data(do)

Get a Data Object from the YubiKey.

Parameters:

do (DO) – The Data Object to get.

Return type:

bytes

put_data(do, data)

Write a Data Object to the YubiKey.

Parameters:

• do (DO) – The Data Object to write to.

• data (Union[bytes, SupportsBytes]) – The data to write.

Return type:

None

get_pin_status()

Get the current status of PINS.

Return type:

PwStatus

get_signature_counter()

Get the number of times the signature key has been used.

Return type:

int

get_application_related_data()

Read the Application Related Data.

Return type:

ApplicationRelatedData

set_signature_pin_policy(pin_policy)

Set signature PIN policy.

Requires Admin PIN verification.

Parameters:

pin_policy (PIN_POLICY) – The PIN policy.

Return type:

None

reset()

Perform a factory reset on the OpenPGP application.

WARNING: This will delete all stored keys, certificates and other data.

Return type:

None

set_pin_attempts(user_attempts, reset_attempts, admin_attempts)

Set the number of PIN attempts to allow before blocking.

WARNING: On YubiKey NEO this will reset the PINs to their default values.

Requires Admin PIN verification.

Parameters:

• user_attempts (int) – The User PIN attempts.

• reset_attempts (int) – The Reset Code attempts.

• admin_attempts (int) – The Admin PIN attempts.

Return type:

None

get_kdf()

Get the Key Derivation Function data object.

Return type:

Kdf

set_kdf(kdf)

Set up a PIN Key Derivation Function.

This enables (or disables) the use of a KDF for PIN verification, as well as resetting the User and Admin PINs to their default (initial) values.

If a Reset Code is present, it will be invalidated.

This command requires Admin PIN verification.

Parameters:

kdf (Kdf) – The key derivation function.

Return type:

None

verify_pin(pin, extended=False)

Verify the User PIN.

This will unlock functionality that requires User PIN verification. Note that with extended=False (default) only sign operations are allowed. Inversely, with extended=True sign operations are NOT allowed.

Parameters:

• pin – The User PIN.

• extended (bool) – If False only sign operations are allowed, otherwise sign operations are NOT allowed.

verify_admin(admin_pin)

Verify the Admin PIN.

This will unlock functionality that requires Admin PIN verification.

Parameters:

admin_pin – The Admin PIN.

unverify_pin(pw)

Reset verification for PIN.

Parameters:

pw (PW) – The User, Admin or Reset PIN

Return type:

None

change_pin(pin, new_pin)

Change the User PIN.

Parameters:

• pin (str) – The current User PIN.

• new_pin (str) – The new User PIN.

Return type:

None

change_admin(admin_pin, new_admin_pin)

Change the Admin PIN.

Parameters:

• admin_pin (str) – The current Admin PIN.

• new_admin_pin (str) – The new Admin PIN.

Return type:

None

set_reset_code(reset_code)

Set the Reset Code for User PIN.

The Reset Code can be used to set a new User PIN if it is lost or becomes blocked, using the reset_pin method.

This command requires Admin PIN verification.

Parameters:

reset_code (str) – The Reset Code for User PIN.

Return type:

None

reset_pin(new_pin, reset_code=None)

Reset the User PIN to a new value.

This command requires Admin PIN verification, or the Reset Code.

Parameters:

• new_pin (str) – The new user PIN.

• reset_code (Optional[str]) – The Reset Code.

Return type:

None

get_algorithm_attributes(key_ref)

Get the algorithm attributes for one of the key slots.

Parameters:

key_ref (KEY_REF) – The key slot.

Return type:

AlgorithmAttributes

get_algorithm_information()

Get the list of supported algorithm attributes for each key.

The return value is a mapping of KEY_REF to a list of supported algorithm attributes, which can be set using set_algorithm_attributes.

Return type:

Mapping[KEY_REF, Sequence[AlgorithmAttributes]]

set_algorithm_attributes(key_ref, attributes)

Set the algorithm attributes for a key slot.

WARNING: This will delete any key already stored in the slot if the attributes are changed!

This command requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• attributes (AlgorithmAttributes) – The algorithm attributes to set.

Return type:

None

get_uif(key_ref)

Get the User Interaction Flag (touch requirement) for a key.

Parameters:

key_ref (KEY_REF) – The key slot.

Return type:

UIF

set_uif(key_ref, uif)

Set the User Interaction Flag (touch requirement) for a key.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• uif (UIF) – The User Interaction Flag.

Return type:

None

get_key_information()

Get the status of the keys.

Return type:

KeyInformation

get_generation_times()

Get timestamps for when keys were generated.

Return type:

GenerationTimes

set_generation_time(key_ref, timestamp)

Set the generation timestamp for a key.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• timestamp (int) – The timestamp.

Return type:

None

get_fingerprints()

Get key fingerprints.

Return type:

Fingerprints

set_fingerprint(key_ref, fingerprint)

Set the fingerprint for a key.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• fingerprint (bytes) – The fingerprint.

Return type:

None

get_public_key(key_ref)

Get the public key from a slot.

Parameters:

key_ref (KEY_REF) – The key slot.

Return type:

PublicKey

generate_rsa_key(key_ref, key_size)

Generate an RSA key in the given slot.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• key_size (RSA_SIZE) – The size of the RSA key.

Return type:

cryptography.hazmat.primitives.asymmetric.rsa.RSAPublicKey

generate_ec_key(key_ref, curve_oid)

Generate an EC key in the given slot.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• curve_oid (CurveOid) – The curve OID.

Return type:

EcPublicKey

put_key(key_ref, private_key)

Import a private key into the given slot.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The key slot.

• private_key (PrivateKey) – The private key to import.

Return type:

None

delete_key(key_ref)

Delete the contents of a key slot.

Requires Admin PIN verification.

Parameters:

key_ref (KEY_REF) – The key slot.

Return type:

None

get_certificate(key_ref)

Get a certificate from a slot.

Parameters:

key_ref (KEY_REF) – The slot.

Return type:

cryptography.x509.Certificate

put_certificate(key_ref, certificate)

Import a certificate into a slot.

Requires Admin PIN verification.

Parameters:

• key_ref (KEY_REF) – The slot.

• certificate (cryptography.x509.Certificate) – The X.509 certificate to import.

Return type:

None

delete_certificate(key_ref)

Delete a certificate in a slot.

Requires Admin PIN verification.

Parameters:

key_ref (KEY_REF) – The slot.

Return type:

None

attest_key(key_ref)

Create an attestation certificate for a key.

The certificate is written to the certificate slot for the key, and its content is returned.

Requires User PIN verification.

Parameters:

key_ref (KEY_REF) – The key slot.

Return type:

cryptography.x509.Certificate

sign(message, hash_algorithm)

Sign a message using the SIG key.

Requires User PIN verification.

Parameters:

• message (bytes) – The message to sign.

• hash_algorithm (cryptography.hazmat.primitives.hashes.HashAlgorithm) – The pre-signature hash algorithm.

Return type:

bytes

decrypt(value)

Decrypt a value using the DEC key.

For RSA the value should be an encrypted block. For ECDH the value should be a peer public-key to perform the key exchange with, and the result will be the derived shared secret.

Requires (extended) User PIN verification.

Parameters:

value (Union[bytes, EcPublicKey]) – The value to decrypt.

Return type:

bytes

authenticate(message, hash_algorithm)

Authenticate a message using the AUT key.

Requires User PIN verification.

Parameters:

• message (bytes) – The message to authenticate.

• hash_algorithm (cryptography.hazmat.primitives.hashes.HashAlgorithm) – The pre-authentication hash algorithm.

Return type:

bytes