From 8c5dfd247548d6ca51e3d795fff56d4643d00384 Mon Sep 17 00:00:00 2001
From: Nemo <me@captnemo.in>
Date: Fri, 25 Dec 2020 12:47:20 +0530
Subject: [PATCH] Adds instructions on changing the PUK

---
 README.md | 28 +++++++++++++++++++++++++---
 1 file changed, 25 insertions(+), 3 deletions(-)

diff --git a/README.md b/README.md
index 47f5c0b..1416c4e 100644
--- a/README.md
+++ b/README.md
@@ -34,6 +34,7 @@ If you have a comment or suggestion, please open an [Issue](https://github.com/d
 - [Export public keys](#export-public-keys)
 - [Configure Smartcard](#configure-smartcard)
   * [Change PIN](#change-pin)
+  * [Change PUK](#change-puk)
   * [Set information](#set-information)
 - [Transfer keys](#transfer-keys)
   * [Signing](#signing-1)
@@ -326,7 +327,7 @@ From YubiKey firmware version 5.2.3 onwards - which introduces "Enhancements to
 ## YubiKey
 
 To feed the system's PRNG with entropy generated by the YubiKey itself, issue:
-```console 
+```console
 $ echo "SCD RANDOM 512" | gpg-connect-agent | sudo tee /dev/random | hexdump -C
 ```
 This will seed the Linux kernel's PRNG with additional 512 bytes retrieved from the YubiKey.
@@ -1269,9 +1270,17 @@ Use the [YubiKey Manager](https://developers.yubico.com/yubikey-manager) applica
 
 ## Change PIN
 
-The default PIN is `123456` and default Admin PIN (PUK) is `12345678`. CCID-mode PINs can be up to 127 ASCII characters. They have to be at least 6 (PIN) or 8 (PUK) ASCII characters.
+Your Yubikey has 2 PINs: The user PIN, which is used for end-user functionality such as signing and encryption and an admin PIN which is required for updating your information on the Yubikey. Entering the user PIN incorrectly three times consecutively will cause the PIN to become blocked.
+
+Name|Default Value
+---|---
+PIN|`123456`
+Admin PIN|`12345678`
+PUK|`12345678`
+
+CCID-mode PINs can be up to 127 ASCII characters. They have to be at least 6 (PIN) or 8 (PUK) ASCII characters. See the GnuPG documentation on [Managing PINs](https://www.gnupg.org/howtos/card-howto/en/ch03s02.html) for details.
 
-The Admin PIN is required for some card operations and to unblock a PIN that has been entered incorrectly more than three times. See the GnuPG documentation on [Managing PINs](https://www.gnupg.org/howtos/card-howto/en/ch03s02.html) for details.
+First set your admin and user PINs:
 
 ```console
 gpg/card> admin
@@ -1307,6 +1316,19 @@ Q - quit
 Your selection? q
 ```
 
+## Change PUK
+
+The PUK (Pin Unlock Key) can be used to reset the PIN if it is ever lost or becomes blocked after the maximum number of incorrect attempts (default 3). The default PUK is `12345678`. If the PUK is also entered incorrectly three times, the key is permanently irrecoverable. You can set your PUK to the same as your daily PIN, giving you a total of 6 attempts.
+
+```console
+ykman piv change-puk
+
+Enter your current PUK:
+Enter your new PUK:
+Repeat for confirmation:
+New PUK set.
+```
+
 ## Set information
 
 Some fields are optional.