Resetting a key, safely

What a reset does

Each applet resets independently — wiping the FIDO function doesn't touch OATH, and so on. In every case the point is the same: keys and credentials are destroyed, not recoverable. Because the secrets only ever lived on the device, there is no backup to restore from unless you made one.

A whole-key reset is a sweep of independent steps, not a single atomic act. Each applet that completes comes back in factory condition, and every step reports its own outcome — so a run can legitimately end with some applets wiped, one failed, and the key still needing attention. Read the report; don't assume a clean slate because the command finished.

• FIDO2 — erases all resident credentials/passkeys, clears the PIN, and wipes the large-blob storage, including a name stored on the key. Any account relying solely on this key for sign-in is locked out until you register a replacement. FIDO2 →
• OATH — removes all stored TOTP/HOTP seeds and clears the applet password. It needs no password to run, which makes it the only way back from a forgotten one. On a Nitrokey 3 it also asks for a touch on the key. You'll need each service's setup secret/QR again. OATH →
• OpenPGP — destroys the on-card sign/encrypt/auth keys and resets PINs. Anything encrypted to the card's encryption key becomes undecryptable. OpenPGP →
• PIV — clears slots, certificates, PIN/PUK, and management key. PIV's reset is a vendor extension, so a whole-device reset first checks what keyroost knows about the card's PIV applet. Where reset is known to work, it sends RESET; if the card wants the PIN and PUK blocked first, keyroost blocks the PIN, tries again, and only then blocks the PUK. If the run stops in between, PIV stays locked and un-wiped until a reset finishes — the per-step report says which state it is in. A card with no entry gets a single RESET and nothing is blocked; a card listed as not supporting it is left out of the sweep, so it is never left locked with no way back. Some cards reset the whole device through their own command instead, and some need the management key or PIN for it — keyroost asks when they do. PIV →
• Token2 on-device OTP — erases every OTP entry stored on the key's own applet. The key asks for a confirming button press before it wipes. On an R3.4+ key this is also the only way back from a blocked OTP PIN — there is no PIN reset. On-device OTP →
• Token2 Molto2 — factory reset wipes loaded slots and restores the default customer key; the token asks you to confirm with its own button. Molto2 →

Before you reset — the checklist

1. Have another way in. A second registered key, or current recovery codes, for every account this key unlocks. Verify it works before wiping.
2. Re-derive what you'll re-add. Make sure you can re-enroll OATH seeds and regenerate or re-import OpenPGP/PIV keys.
3. Decryption keys are special. Data encrypted to an OpenPGP encryption key or PIV key-management slot can't be read after the key is gone — decrypt or re-key it first.
4. Then reset, set a fresh PIN, and re-register before relying on it.

How keyroost treats resets

Resetting a whole key at once

One command wipes every resettable applet the key exposes, in order — OATH, OpenPGP, Token2 on-device OTP, PIV, then FIDO2 last, because it ends with a ceremony:

keyroostctl factory-reset                       # asks you to type "reset"
keyroostctl factory-reset --device my-key --yes  # in a script

The card applets need nothing from you, except that some keys (a Nitrokey 3) ask for a touch to reset OATH and the Token2 OTP step waits for a confirming button press; keyroost says to touch the key during those steps, in the CLI and on the app's Factory reset card. What the FIDO2 step asks for depends on the device's shape. A USB key is asked to be unplugged and plugged back in within 60 seconds — keyroost notices the replug on its own, no Enter needed — and then touched. keyroost records the key's identity before the sweep starts and verifies the key that comes back after the replug is the one you confirmed. A key that exposes no serial can only be reset while it is the only device connected; otherwise the reset is refused before anything is wiped, naming the devices to unplug. If no replug is seen, nothing is sent and the step is reported as skipped. A card in a smart-card reader has nothing to unplug and no touch surface, so it is reset in place: keyroost resets the card in the reader (which opens the same brief after-power-up window a replug does) and sends the wipe immediately. The same in-place path is available on its own as keyroostctl fido reset --reader <name>. Each step prints its own result, the command ends with a line like factory reset: 5 wiped, 0 skipped, 0 failed, and it exits nonzero if any step failed or was skipped.

The desktop app offers the same sweep as a Factory reset card on a key's Overview tab, with a live per-step report — including a FIDO2 row — so you can see exactly which applets came back clean and which need another pass.

The Token2 Molto2 is not part of this sweep; it has its own keyroostctl molto reset, which also needs a physical button confirmation on the token. Molto2 →