docs: Address inconsistencies and obsolete class references

[DennisDyallo]

This pull request updates the documentation to reflect recent SDK API changes, improve code clarity, and fix minor errors. The most significant changes include updating cryptographic key type names and usages, improving code examples for key and certificate handling, and correcting parameter and type usages to align with the latest SDK conventions.

API and Type Updates:

• Replaced older key and algorithm types (e.g., PivAlgorithm.Rsa2048, PivPublicKey, PivEccPrivateKey, PivRsaPrivateKey) with new types (KeyType.RSA2048, KeyType.ECP256, IPublicKey, IPrivateKey, RSAPrivateKey, ECPrivateKey, RSAPublicKey) across all code examples and method signatures for consistency with the updated SDK. [1] [2] [3] [4] [5] [6] [7]

• Updated cryptographic parameter handling in code samples to use the .Parameters property of key objects (e.g., RSAPublicKey.Parameters, ECPrivateKey.Parameters) instead of accessing individual fields or using deprecated types. [1] [2] [3] [4]

Secure Channel Protocol (SCP) Improvements:

• Updated SCP11 and SCP03 example usages to use new parameter construction methods (e.g., ECPublicKey.CreateFromParameters, ECPrivateKey.CreateFromParameters, Scp03KeyParameters) instead of deprecated or incorrect types. [1] [2] [3] [4] [5] [6] [7] [8]

Code Example Corrections and Improvements:

• Fixed code sample errors and improved clarity, such as correcting method calls, exception throwing, and memory handling in key collector examples. [1] [2] [3]

• Added comments and notes to highlight important security considerations (e.g., inability to securely wipe strings from memory in PIN handling).

Documentation and Terminology Updates:

• Updated documentation to reflect the new way of retrieving device information and checking FIPS mode, using the IYubiKeyDevice interface instead of command-based approaches. [1] [2]

• Updated code block language identifiers for syntax highlighting (e.g., csharp).

These changes ensure the documentation is accurate, up-to-date with the SDK, and provides clearer guidance for users.

[Copilot]

Pull request overview

This PR updates the user manual docs to align code examples with newer SDK APIs, especially around PIV key types and SCP secure channel usage.

Changes:

• Updated PIV-related docs/examples to use KeyType, IPublicKey/IPrivateKey, and the newer RSA/EC key classes and .Parameters access patterns.
• Updated SCP03/SCP11 documentation snippets to use newer key construction helpers (e.g., ECPublicKey.CreateFromParameters, ECPrivateKey.CreateFromParameters, Scp03KeyParameters).
• Fixed and clarified several documentation samples (syntax highlighting tags, key collector examples, device info retrieval).

Reviewed changes

Copilot reviewed 10 out of 10 changed files in this pull request and generated 10 comments.

Show a summary per file

File	Description
docs/users-manual/sdk-programming-guide/secure-channel-protocol.md	Updates SCP03/SCP11 examples to newer SCP/key APIs and key type names.
docs/users-manual/sdk-programming-guide/key-collector.md	Fixes key collector sample code and updates memory handling in examples.
docs/users-manual/getting-started/overview-of-sdk.md	Updates PIV key generation example to use KeyType.RSA2048.
docs/users-manual/application-u2f/fips-mode.md	Updates FIPS detection examples to use IYubiKeyDevice-based device info access.
docs/users-manual/application-security-domain/security-domain-keys.md	Updates Security Domain key import examples to use ECPrivateKey/ECPublicKey factories.
docs/users-manual/application-piv/cert-request.md	Updates public key handling example to new public key types and .Parameters.
docs/users-manual/application-piv/attestation.md	Updates attestation API references and key/cert matching examples to new key types.
docs/users-manual/application-piv/access-control.md	Updates access-control example to IPublicKey and KeyType.
docs/users-manual/application-oath/oath-credentials.md	Updates code block language tag for syntax highlighting.
docs/users-manual/application-fido2/fido2-pin.md	Adds a note about secure wiping limitations when using string for PIN handling.

Comments suppressed due to low confidence (1)

docs/users-manual/application-oath/oath-credentials.md:149

• This code block now has csharp highlighting, but the sample shown is not valid C#: object initializers are missing trailing semicolons, Type should be assigned using CredentialType.Totp/CredentialType.Hotp, and the property name in the SDK is RequiresTouch (see Oath sample code). Please update the snippet so it compiles as-written.

```csharp
// create TOTP credential
var credential = new Credential {
    Issuer = "Yubico",
    AccountName = "test@yubico.com",
    Type = Totp,
    Period = 30,
    Digits = 6,
    Secret = "HXDMVJECJJWSRB3HWIZR4IFUGFTMXBOZ",
    RequireTouch = false
}

[DennisDyallo]

@claude Review and fix the Copilot findings

[claude]

Claude finished @DennisDyallo's task in 3m 35s —— View job

---

Fixed Copilot Findings

• Read relevant files
• Fix secure-channel-protocol.md issues:
  • certificateList → certificates + missing semicolon (line 100)
  • scp03params → scp03Params casing (4 locations: PIV, OATH, OTP, YubiHSM)
  • GenerateEcKey missing replaceKvn argument → GenerateEcKey(keyReference, 0) (line 446)
  • Unnecessary ECPublicKey.CreateFromParameters(newPublicKey.Parameters) → simplified to newPublicKey (SCP11a)
• Fix fips-mode.md: First() → FirstOrDefault() ?? throw new InvalidOperationException(...) (2 locations)
• Fix key-collector.md: added MyKeyCollector() constructor to initialize CurrentValue = new Memory<byte>(_currentValue)
• Commit and push changes

All 8 Copilot findings addressed in commit 57e6003.
|

[equijano21]

Awesome! I'll review this tomorrow.

[equijano21]

Just for my own understanding, is the try-finally block ideal here just because it makes it easier to call ZeroMemory?

[DennisDyallo]

Yes its a common pattern. That code is guaranteed to execute, whether or not the surrounding code fails, ensuring a clear of the buffer

[equijano21]

Awesome, thanks for the info :)

[equijano21]

So the examples in the OTP how-to docs showing credential configuration using generated secret keys/values have been updated to show the ZeroMemory sensitive data handling—what about the examples with secret keys/values that are provided directly and defined elsewhere? Should we be clearing those from memory in the same way after configuration, or are there situations where developers would prefer to handle the data differently?

[DennisDyallo]

I'd say so, yeah. It's good to demo the best practices even when we show examples

[DennisDyallo]

@equijano21 addressed your findings! :)