# Establish a session with the default Authentication Key
yubihsm> connect
Session keepalive set up to run every 15 seconds
yubihsm> session open 1 password
Created session 0
# Create an Authentication Key for Auditing
yubihsm> put authkey 0 0 "Audit auth key" all get-log-entries none $AUDIT_PASS
Stored Authentication key 0xd054
# Create a Wrap Key for importing application Authentication Keys and secrets
yubihsm> get random 0 16
5b61e89468cc8f2a274715c78c3d4753
yubihsm> put wrapkey 0 0 "HMAC wrap Key" all import-wrapped sign-hmac:verify-hmac 5b61e89468cc8f2a274715c78c3d4753
Stored Wrap key 0xf09a
# Create an Authentication Key for use with the above Wrap Key
yubihsm> put authkey 0 0 "Provisioning HMAC wrap auth key" all import-wrapped none $WRAP_PASS
Stored Authentication key 0xf10f
# Delete the default Authentication Key
yubihsm> delete 0 1 authentication-key
# Create a wrapped Authentication Key and HMAC Key for the application
echo -ne '\x5b\x61\xe8\x94\x68\xcc\x8f\x2a\x27\x47\x15\xc7\x8c\x3d\x47\x53' > wrap.key
echo $HMAC_PASS | yubihsm-wrap -a aes128-yubico-authentication -c sign-hmac,verify-hmac -d 1 -l "HMAC auth key" -k wrap.key --in - --out auth.out -e none
echo -ne '\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b\x0b' > hmac.key
yubihsm-wrap -a hmac-sha256 -c sign-hmac,verify-hmac -d 1 -l "HMAC key" -k wrap.key --in hmac.key --out hmac.out
# Open a Session with the wrap Authentication Key
yubihsm> session open 0xf10f $WRAP_PASS
Created session 1
# Import the two wrapped keys in the new Session
yubihsm> put wrapped 1 0xf09a auth.out
Object imported as 0x2a74 of type authentication-key
yubihsm> put wrapped 1 0xf09a hmac.out
Object imported as 0xd1a2 of type hmac-key
# Open a session with the new application Authentication Key
yubihsm> session open 0x2a74 $HMAC_PASS
Created session 2
# Run HMAC-SHA256 Test vector #1 and get expected output
yubihsm> hmac 2 0xd1a2 4869205468657265
b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7
echo -ne '\x48\x69\x20\x54\x68\x65\x72\x65' | openssl dgst -hex -mac hmac -macopt hexkey:0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b0b -sha256
(stdin)= b0344c61d8db38535ca8afceaf0bf12b881dc200c9833da726e9376c2e32cff7