Skip to content

Commit 1b52719

Browse files
JMarkstromvirot
JMarkstrom
and
virot
authored
Prf encryption (#197)
Allow for encryption of files using the FIDO2 PRF extension. --------- Co-authored-by: Oscar Virot <virot@virot.com>
1 parent 6508b5c commit 1b52719

8 files changed

Lines changed: 1092 additions & 4 deletions

File tree

‎Docs/Commands/Protect-YubiKeyFIDO2File.md‎

Lines changed: 265 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,265 @@
1+
---
2+
document type: cmdlet
3+
external help file: powershellYK.dll-Help.xml
4+
HelpUri: ''
5+
Locale: en-SE
6+
Module Name: powershellYK
7+
ms.date: 03-26-2026
8+
PlatyPS schema version: 2024-05-01
9+
title: Protect-YubiKeyFIDO2File
10+
---
11+
12+
# Protect-YubiKeyFIDO2File
13+
14+
## SYNOPSIS
15+
16+
Encrypts a file using FIDO2 PRF (hmac-secret) extension on a YubiKey.
17+
18+
## SYNTAX
19+
20+
### WithCredential (Default)
21+
22+
```
23+
Protect-YubiKeyFIDO2File -Path <FileInfo> -Credential <Credential> [-OutFile <FileInfo>] [-WhatIf]
24+
[-Confirm] [<CommonParameters>]
25+
```
26+
27+
### WithCredentialID
28+
29+
```
30+
Protect-YubiKeyFIDO2File -Path <FileInfo> -CredentialID <CredentialID> -RelyingPartyID <string>
31+
[-OutFile <FileInfo>] [-WhatIf] [-Confirm] [<CommonParameters>]
32+
```
33+
34+
### ByRelyingPartyID
35+
36+
```
37+
Protect-YubiKeyFIDO2File -Path <FileInfo> -RelyingPartyID <string> [-OutFile <FileInfo>] [-WhatIf]
38+
[-Confirm] [<CommonParameters>]
39+
```
40+
41+
## ALIASES
42+
43+
This cmdlet has the following aliases,
44+
{{Insert list of aliases}}
45+
46+
## DESCRIPTION
47+
48+
Encrypts a file using FIDO2 PRF (hmac-secret) extension on a YubiKey.
49+
Uses HKDF-SHA256 for key derivation and AES-256-GCM for authenticated encryption.
50+
Requires a YubiKey with FIDO2 hmac-secret support and administrator privileges on Windows.
51+
52+
## EXAMPLES
53+
54+
### Example 1
55+
56+
```powershell
57+
$cred = Get-YubiKeyFIDO2Credential | Where-Object { $_.RelyingParty.Id -eq "demo.yubico.com" }
58+
Protect-YubiKeyFIDO2 -Path .\secret.txt -Credential $cred
59+
```
60+
Encrypts secret.txt using the specified FIDO2 credential
61+
62+
### Example 2
63+
64+
```powershell
65+
Get-Item .\secret.txt | Protect-YubiKeyFIDO2 -Credential $cred
66+
```
67+
Encrypts a file via pipeline input
68+
69+
### Example 3
70+
71+
```powershell
72+
Protect-YubiKeyFIDO2 -Path .\secret.txt -RelyingPartyID "demo.yubico.com"
73+
```
74+
Encrypts using the sole credential for that relying party (aliases -RP and -Origin).
75+
76+
## PARAMETERS
77+
78+
### -Confirm
79+
80+
Prompts you for confirmation before running the cmdlet.
81+
82+
```yaml
83+
Type: System.Management.Automation.SwitchParameter
84+
DefaultValue: ''
85+
SupportsWildcards: false
86+
Aliases:
87+
- cf
88+
ParameterSets:
89+
- Name: (All)
90+
Position: Named
91+
IsRequired: false
92+
ValueFromPipeline: false
93+
ValueFromPipelineByPropertyName: false
94+
ValueFromRemainingArguments: false
95+
DontShow: false
96+
AcceptedValues: []
97+
HelpMessage: ''
98+
```
99+
100+
### -Credential
101+
102+
Credential object from Get-YubiKeyFIDO2Credential.
103+
104+
```yaml
105+
Type: powershellYK.FIDO2.Credential
106+
DefaultValue: ''
107+
SupportsWildcards: false
108+
Aliases: []
109+
ParameterSets:
110+
- Name: WithCredential
111+
Position: Named
112+
IsRequired: true
113+
ValueFromPipeline: false
114+
ValueFromPipelineByPropertyName: true
115+
ValueFromRemainingArguments: false
116+
DontShow: false
117+
AcceptedValues: []
118+
HelpMessage: ''
119+
```
120+
121+
### -CredentialID
122+
123+
Credential ID to use.
124+
125+
```yaml
126+
Type: powershellYK.FIDO2.CredentialID
127+
DefaultValue: ''
128+
SupportsWildcards: false
129+
Aliases: []
130+
ParameterSets:
131+
- Name: WithCredentialID
132+
Position: Named
133+
IsRequired: true
134+
ValueFromPipeline: false
135+
ValueFromPipelineByPropertyName: false
136+
ValueFromRemainingArguments: false
137+
DontShow: false
138+
AcceptedValues: []
139+
HelpMessage: ''
140+
```
141+
142+
### -OutFile
143+
144+
Output file path. Defaults to input path with .enc extension.
145+
146+
```yaml
147+
Type: System.IO.FileInfo
148+
DefaultValue: ''
149+
SupportsWildcards: false
150+
Aliases: []
151+
ParameterSets:
152+
- Name: (All)
153+
Position: Named
154+
IsRequired: false
155+
ValueFromPipeline: false
156+
ValueFromPipelineByPropertyName: false
157+
ValueFromRemainingArguments: false
158+
DontShow: false
159+
AcceptedValues: []
160+
HelpMessage: ''
161+
```
162+
163+
### -Path
164+
165+
Input file to encrypt.
166+
167+
```yaml
168+
Type: System.IO.FileInfo
169+
DefaultValue: ''
170+
SupportsWildcards: false
171+
Aliases: []
172+
ParameterSets:
173+
- Name: (All)
174+
Position: Named
175+
IsRequired: true
176+
ValueFromPipeline: true
177+
ValueFromPipelineByPropertyName: false
178+
ValueFromRemainingArguments: false
179+
DontShow: false
180+
AcceptedValues: []
181+
HelpMessage: ''
182+
```
183+
184+
### -RelyingPartyID
185+
186+
Relying Party ID for the assertion.
187+
188+
```yaml
189+
Type: System.String
190+
DefaultValue: ''
191+
SupportsWildcards: false
192+
Aliases:
193+
- RP
194+
- Origin
195+
ParameterSets:
196+
- Name: WithCredentialID
197+
Position: Named
198+
IsRequired: true
199+
ValueFromPipeline: false
200+
ValueFromPipelineByPropertyName: false
201+
ValueFromRemainingArguments: false
202+
- Name: ByRelyingPartyID
203+
Position: Named
204+
IsRequired: true
205+
ValueFromPipeline: false
206+
ValueFromPipelineByPropertyName: false
207+
ValueFromRemainingArguments: false
208+
DontShow: false
209+
AcceptedValues: []
210+
HelpMessage: ''
211+
```
212+
213+
### -WhatIf
214+
215+
Runs the command in a mode that only reports what would happen without performing the actions.
216+
217+
```yaml
218+
Type: System.Management.Automation.SwitchParameter
219+
DefaultValue: ''
220+
SupportsWildcards: false
221+
Aliases:
222+
- wi
223+
ParameterSets:
224+
- Name: (All)
225+
Position: Named
226+
IsRequired: false
227+
ValueFromPipeline: false
228+
ValueFromPipelineByPropertyName: false
229+
ValueFromRemainingArguments: false
230+
DontShow: false
231+
AcceptedValues: []
232+
HelpMessage: ''
233+
```
234+
235+
### CommonParameters
236+
237+
This cmdlet supports the common parameters: -Debug, -ErrorAction, -ErrorVariable,
238+
-InformationAction, -InformationVariable, -OutBuffer, -OutVariable, -PipelineVariable,
239+
-ProgressAction, -Verbose, -WarningAction, and -WarningVariable. For more information, see
240+
[about_CommonParameters](https://go.microsoft.com/fwlink/?LinkID=113216).
241+
242+
## INPUTS
243+
244+
### System.IO.FileInfo
245+
246+
{{ Fill in the Description }}
247+
248+
### powershellYK.FIDO2.Credential
249+
250+
{{ Fill in the Description }}
251+
252+
## OUTPUTS
253+
254+
### System.Object
255+
256+
{{ Fill in the Description }}
257+
258+
## NOTES
259+
260+
{{ Fill in the Notes }}
261+
262+
## RELATED LINKS
263+
264+
{{ Fill in the related links here }}
265+

0 commit comments

Comments
 (0)