Cannot generate RSA-OAEP key pair? about yubihsm-shell HOT 3 CLOSED

rsa-oaep-sha384 is a decryption algorithm, not a key algorithm. When generating an asymmetric key, the last parameter is expected to be a key algorithm. If you are trying to generate an RSA key, the only options are rsa2048, rsa3072 or rsa4096. If you want this RSA key to be used to decrypt OAEP, the way to do it is to specify that in its capabilities, which you seem to have done, but you also gave it the capability to decrypt using RSA-PKCS1v1.5. So if you want it to only be used for decrypting OAEP, remove decrypt-pkcs from the capabilities parameter

from yubihsm-shell.

Understood, thanks.

I wish there was an obvious delineation in the Help, defining what algorithms are for keys...

from yubihsm-shell.

While the help in the commandline can be too general sometimes, docs.yubico.com has a more detailed documentation. See this page for a list of algorithms and what they are used for: https://docs.yubico.com/hardware/yubihsm-2/hsm-2-user-guide/hsm2-core-concepts.html#algorithms. There's also this list of commands with paramter details: https://docs.yubico.com/hardware/yubihsm-2/hsm-2-user-guide/hsm2-cmd-reference.html

from yubihsm-shell.