anchor.diff:  
   *-Nkey*:: use the nth YubiKey found.
   
  -*−1*:: change the first configuration. This is the default and is
  +*-1*:: change the first configuration. This is the default and is
   normally used for true OTP generation. In this configuration, the option
   flag *-oappend-cr* is set by default.
   
  -*−2*:: change the second configuration. This is for YubiKey II only
  +*-2*:: change the second configuration. This is for YubiKey II only
   and is then normally used for static key generation. In this
   configuration, the option flags **-oappend-cr**, **-ostatic-ticket**,
   **-ostrong-pw1**, *-ostrong-pw2* and *-oman-update* are set by default.
   
   *-z*:: delete configuration in selected slot
   
  -*−s*'file':: save configuration to file instead of key. (if file
  +*-s*'file':: save configuration to file instead of key. (if file
   is -, send to stdout)
   
  -*−i*'file':: read configuration from file. (if file is -, read
  +*-i*'file':: read configuration from file. (if file is -, read
   from stdin) Configuration import is only valid for the ycfg format.
   
  -*−f*'format':: format to be used with *-s* and *-i*. Valid options are *ycfg* and *legacy*.
  -
  -*−a*['xxx']:: the AES secret key as a 32 (or 40 for OATH-HOTP/HMAC CHAL-RESP) char hex value (not modhex) (none to prompt for key on stdin) If *−a* is not used a random key will be generated.
  -
  -*−c*'xxx':: A 12 char hex value (not modhex) to use as access
  +*-f*'format':: format to be used with *-s* and *-i*. Valid options are *ycfg* and *legacy*.
  +
  +*-a*['xxx']:: the AES secret key as a 32 (or 40 for OATH-HOTP/HMAC CHAL-RESP) char hex value (not modhex) (none to prompt for key on stdin) If *-a* is not used a random key will be generated.
  +
  +*-c*'xxx':: A 12 char hex value (not modhex) to use as access
   code for programming. NOTE: this does NOT SET the access code, that’s
   done with **-oaccess**__=__.
   
  -*−o*'option':: change configuration option. Possible option arguments are:
  +*-o*'option':: change configuration option. Possible option arguments are:
   
   *fixed*='fffffffffff'::: The modhex _public identity_ of the YubiKey, 0-32 characters long
   (encoding up to 16 bytes). It’s possible to give the identity in hex as
  
positive.code: ~~~~~~~~~~~~~~
  
  When using OATH-HOTP mode, a HMAC key of 160 bits (20 bytes, 40 chars of
  hex) can be supplied with *−a*.
  
  
  Challenge-response Mode
  
negative.code: 
  
  === YubiKey 2.2 firmware and above
  [-]*chal-yubico*::
  
  Yubico OTP challenge-response mode.
  
  [-]*chal-hmac*::
  
  Generate HMAC-SHA1 challenge responses.
  
  [-]*hmac-lt64*::
  
  Calculate HMAC on less than 64 bytes input. Whatever is in the last byte
  of the challenge is used as end of input marker (backtracking from end
  of payload).
  
  [-]*chal-btn-trig*::
  
  The YubiKey will wait for the user to press the key (within 15 seconds)
  before answering the challenge.
  
  [-]*serial-btn-visible*::
  
  The YubiKey will emit its serial number if the button is pressed during
  power-up. This option is only valid for the 2.x firmware line.
  
  [-]*serial-usb-visible*::
  
  The YubiKey will indicate its serial number in the USB iSerial field.
  This option is not available in the 3.0 and 3.1 firmwares.
  
  [-]*serial-api-visible*::
  
  The YubiKey will allow its serial number to be read using an API call.
  
  