s32sdaf-change-password

Imported from nxp-agentic-ai/s32-ds-ai-support (skills/s32sdaf/s32sdaf-change-password/SKILL.md). Install upstream with npx skills add nxp-agentic-ai/s32-ds-ai-support --skill s32sdaf-change-password. Copyright stays with the author (LA_OPT_Online Code Hosting NXP_Software_).

Set or Update the Smart-Card User Password

Set the first Volkano smart-card user password on a newly initialized card, or update an existing password on an already-provisioned card. Both cases use the volkano.exe command update_pwd; the difference is whether -pw <current password> is required.

When to use

Use this skill to set the first user password on a newly initialized smart card, to change an existing smart-card password, or to confirm the exact command shape, constraints, and safety rules for password initialization/update.

Do not use it for registering or wrapping keys, generating challenge responses, deleting UID records, guessing passwords, or changing unrelated OS/IDE/Windows credentials.

Available Capabilities

The S32SDAF MCP server exposes three tools (status, search_actions, execute_action). Password init/update is available through execute_action(action="update_pwd", params={"new_password": ..., "current_password": ...}): omit current_password for first-password initialization, and supply it (passed as -pw) when updating an already-provisioned card. The wrapper runs the documented volkano.exe -cmd update_pwd command. The library API vlk_update_password(const char* newPwd) mirrors this and requires authentication when a password is already provisioned.

Grounded command reference

From the S32SDAF knowledge base (SDAF_User_Guide.pdf): update_pwd sets or updates the smart-card user password with -new_pwd <new password>. -pw is not required for the first password; -pw <current password> is mandatory for subsequent updates.

• First-password init: volkano.exe -cmd update_pwd -new_pwd vlk1234
• Update existing: volkano.exe -cmd update_pwd -new_pwd 1234 -pw vlk1234

Password rules: must not be null; length 4 to 127 characters.

Quickstart

1. If readiness is unknown, run status (optionally execute_action(action="find_installation") / execute_action(action="discover", params={...})).
2. Require an explicit new_password; validate length 4..127.
3. Newly initialized card -> omit -pw. Existing password -> require and include -pw <current_password> (also 4..127).
4. Run the matching volkano.exe -cmd update_pwd ... form.
5. Inform the user that future authenticated operations must use the new password.

Workflow

1. Confirm readiness if needed. Use status; resolve install path with execute_action(action="find_installation"); confirm card presence with execute_action(action="discover", params={...}) if the card state is unknown - do not assume the card is initialized.
2. Validate inputs locally. Require new_password; verify length 4..127. For an update, require current_password and verify its length 4..127. Do not log or echo secrets.
3. Choose the command form. First-password initialization (newly initialized card, no user password yet) omits -pw. Updating an already-provisioned password includes -pw <current_password>.
4. Execute.
   • Init: volkano.exe -cmd update_pwd -new_pwd <new_password>
   • Update: volkano.exe -cmd update_pwd -new_pwd <new_password> -pw <current_password> Prefer an MCP wrapper if one becomes available instead of ad hoc strings.
5. Confirm outcome. Tell the user future authenticated Volkano operations must use the new password; optionally recommend a follow-up authenticated operation to confirm end-to-end readiness. Do not expose the password.

Guardrails

Scope - Persistent smart-card credential mutation. Not a read-only workflow; it sets or replaces the user password.

Destructive actions - Replacing the password causes subsequent operations with the old password to fail. Require the user to supply the intended new password explicitly; never guess current or new passwords.

Secrets - Do not log, repeat, or store passwords unnecessarily in responses or transcripts.

Refuse-and-escalate -

• Missing new_password: stop and request it.
• Update case missing current_password: stop; -pw is mandatory for subsequent updates.
• Invalid length: report the 4..127 requirement.
• Incorrect current password reported by Volkano: ask for the correct one; do not retry with fabricated credentials.
• Card unavailable: ask the user to verify insertion/reader, recommend a discovery check.
• No execution surface for update_pwd: explain the workflow is grounded, provide the exact command, and recommend adding a dedicated MCP wrapper.

Validation loop

1. Confirm init-vs-update case is correctly identified.
2. Confirm new_password present and 4..127; for updates confirm current_password present and 4..127.
3. Confirm the correct volkano.exe update_pwd command form is selected.
4. Execute (or emit) the command.
5. Pass criterion: the password is set/updated and the user is told the new password must be used for future authenticated operations.

Out of scope

• Registering, wrapping, or deleting keys/records.
• Challenge-response authentication itself.
• Changing OS/IDE/Windows or other non-Volkano credentials.

See Also

• Related skills: s32sdaf-discovery-and-status (readiness before change), s32sdaf-register-key / s32sdaf-wrap-and-register (next-step provisioning), s32sdaf-auth-device (authenticate after password setup).