5.4.4 Invoking tpmtool

Program that allows handling cryptographic data from the TPM chip.

This section was generated by AutoGen, using the agtexi-cmd template and the option descriptions for the tpmtool program. This software is released under the GNU General Public License, version 3 or later.

5.4.5 tpmtool help/usage (--help)

This is the automatically generated usage text for tpmtool.

The text printed is the same whether selected with the help option (--help) or the more-help option (--more-help). more-help will print the usage text by passing it through a pager program. more-help is disabled on platforms without a working fork(2) function. The PAGER environment variable is used to select the program, defaulting to more. Both will exit with a status code of 0.

tpmtool is unavailable - no --help

5.4.6 debug option (-d)

This is the “enable debugging” option. This option takes a number argument. Specifies the debug level.

5.4.7 generate-rsa option

This is the “generate an rsa private-public key pair” option. Generates an RSA private-public key pair in the TPM chip. The key may be stored in filesystem and protected by a PIN, or stored (registered) in the TPM chip flash.

5.4.8 user option

This is the “any registered key will be a user key” option.

This option has some usage constraints. It:

• must appear in combination with the following options: register.
• must not appear in combination with any of the following options: system.

The generated key will be stored in a user specific persistent storage.

5.4.9 system option

This is the “any registred key will be a system key” option.

This option has some usage constraints. It:

• must appear in combination with the following options: register.
• must not appear in combination with any of the following options: user.

The generated key will be stored in system persistent storage.

5.4.10 sec-param option

This is the “specify the security level [low, legacy, medium, high, ultra].” option. This option takes a string argument Security parameter. This is alternative to the bits option. Note however that the values allowed by the TPM chip are quantized and given values may be rounded up.

5.4.11 inder option

This is the “use the der format for keys.” option.

This option has some usage constraints. It:

• can be disabled with –no-inder.

The input files will be assumed to be in the portable DER format of TPM. The default format is a custom format used by various TPM tools

5.4.12 outder option

This is the “use der format for output keys” option.

This option has some usage constraints. It:

• can be disabled with –no-outder.

The output will be in the TPM portable DER format.

5.4.13 tpmtool exit status

One of the following exit values will be returned:

‘0 (EXIT_SUCCESS)’

Successful program execution.

‘1 (EXIT_FAILURE)’

The operation failed or the command syntax was not valid.

5.4.14 tpmtool See Also

p11tool (1), certtool (1)

5.4.15 tpmtool Examples

To generate a key that is to be stored in filesystem use:

$ tpmtool --generate-rsa --bits 2048 --outfile tpmkey.pem

To generate a key that is to be stored in TPM’s flash use:

$ tpmtool --generate-rsa --bits 2048 --register --user

To get the public key of a TPM key use:

$ tpmtool --pubkey tpmkey:uuid=58ad734b-bde6-45c7-89d8-756a55ad1891;storage=user \
          --outfile pubkey.pem

or if the key is stored in the filesystem:

$ tpmtool --pubkey tpmkey:file=tmpkey.pem --outfile pubkey.pem

To list all keys stored in TPM use:

$ tpmtool --list