1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
244
245
246
247
248
249
250
251
252
253
254
255
256
257
258
259
260
261
262
263
264
265
266
267
268
269
270
271
272
273
274
275
276
277
278
279
280
281
282
283
284
285
286
287
288
289
290
291
292
293
294
295
296
297
298
299
300
301
302
303
304
305
306
307
308
309
310
311
312
313
314
315
316
317
318
319
320
321
322
323
324
325
326
327
328
329
330
331
332
333
334
335
336
337
338
339
340
341
342
343
344
345
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363
364
365
366
367
368
369
|
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">
<html>
<!-- This manual is last updated 4 March 2015 for version
3.4.9 of GnuTLS.
Copyright (C) 2001-2015 Free Software Foundation, Inc.\\
Copyright (C) 2001-2015 Nikos Mavrogiannopoulos
Permission is granted to copy, distribute and/or modify this document
under the terms of the GNU Free Documentation License, Version 1.3 or
any later version published by the Free Software Foundation; with no
Invariant Sections, no Front-Cover Texts, and no Back-Cover Texts. A
copy of the license is included in the section entitled "GNU Free
Documentation License". -->
<!-- Created by GNU Texinfo 6.0, http://www.gnu.org/software/texinfo/ -->
<head>
<title>GnuTLS 3.4.9: tpmtool Invocation</title>
<meta name="description" content="GnuTLS 3.4.9: tpmtool Invocation">
<meta name="keywords" content="GnuTLS 3.4.9: tpmtool Invocation">
<meta name="resource-type" content="document">
<meta name="distribution" content="global">
<meta name="Generator" content="makeinfo">
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<link href="index.html#Top" rel="start" title="Top">
<link href="Function-and-Data-Index.html#Function-and-Data-Index" rel="index" title="Function and Data Index">
<link href="index.html#SEC_Contents" rel="contents" title="Table of Contents">
<link href="Trusted-Platform-Module.html#Trusted-Platform-Module" rel="up" title="Trusted Platform Module">
<link href="How-to-use-GnuTLS-in-applications.html#How-to-use-GnuTLS-in-applications" rel="next" title="How to use GnuTLS in applications">
<link href="Using-keys.html#Using-keys" rel="prev" title="Using keys">
<style type="text/css">
<!--
a.summary-letter {text-decoration: none}
blockquote.indentedblock {margin-right: 0em}
blockquote.smallindentedblock {margin-right: 0em; font-size: smaller}
blockquote.smallquotation {font-size: smaller}
div.display {margin-left: 3.2em}
div.example {margin-left: 3.2em}
div.lisp {margin-left: 3.2em}
div.smalldisplay {margin-left: 3.2em}
div.smallexample {margin-left: 3.2em}
div.smalllisp {margin-left: 3.2em}
kbd {font-style: oblique}
pre.display {font-family: inherit}
pre.format {font-family: inherit}
pre.menu-comment {font-family: serif}
pre.menu-preformatted {font-family: serif}
pre.smalldisplay {font-family: inherit; font-size: smaller}
pre.smallexample {font-size: smaller}
pre.smallformat {font-family: inherit; font-size: smaller}
pre.smalllisp {font-size: smaller}
span.nocodebreak {white-space: nowrap}
span.nolinebreak {white-space: nowrap}
span.roman {font-family: serif; font-weight: normal}
span.sansserif {font-family: sans-serif; font-weight: normal}
ul.no-bullet {list-style: none}
body {
margin: 2%;
padding: 0 5%;
background: #ffffff;
}
h1,h2,h3,h4,h5 {
font-weight: bold;
padding: 5px 5px 5px 5px;
background-color: #c2e0ff;
color: #336699;
}
h1 {
padding: 2em 2em 2em 5%;
color: white;
background: #336699;
text-align: center;
letter-spacing: 3px;
}
h2 { text-decoration: underline; }
pre {
margin: 0 5%;
padding: 0.5em;
}
pre.example,pre.verbatim {
padding-bottom: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 1px 1px 1px 5px;
margin: 1em auto;
width: 90%;
}
div.node {
margin: 0 -5% 0 -2%;
padding: 0.5em 0.5em;
margin-top: 0.5em;
margin-bottom: 0.5em;
font-weight: bold;
}
dd, li {
padding-top: 0.1em;
padding-bottom: 0.1em;
}
div.float {
margin-bottom: 0.5em;
text-align: center;
}
table {
text-align: left;
margin-left:auto;
margin-right:auto;
border-spacing: 7px;
width: 50%;
}
th {
padding: 0;
color: #336699;
background-color: #c2e0ff;
border: solid #000000;
border-width: 0px;
margin: 1em auto;
text-align: center;
margin-left:auto;
margin-right:auto;
}
td {
padding: 0;
border: solid #000000;
background-color: #f0faff;
border-width: 0px;
margin: 1em auto;
text-align: left;
margin-left:auto;
margin-right:auto;
padding-left: 1em;
}
dl {
text-align: left;
margin-left:auto;
margin-right:auto;
width: 50%;
padding-left: 1em;
border: solid #c2e0ff;
background: #f0faff;
border-width: 5px 1px 1px 1px;
margin: 1em auto;
}
-->
</style>
</head>
<body lang="en">
<a name="tpmtool-Invocation"></a>
<div class="header">
<p>
Previous: <a href="Using-keys.html#Using-keys" accesskey="p" rel="prev">Using keys</a>, Up: <a href="Trusted-Platform-Module.html#Trusted-Platform-Module" accesskey="u" rel="up">Trusted Platform Module</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
<hr>
<a name="Invoking-tpmtool"></a>
<h4 class="subsection">5.4.4 Invoking tpmtool</h4>
<a name="index-tpmtool"></a>
<p>Program that allows handling cryptographic data from the TPM chip.
</p>
<p>This section was generated by <strong>AutoGen</strong>,
using the <code>agtexi-cmd</code> template and the option descriptions for the <code>tpmtool</code> program.
This software is released under the GNU General Public License, version 3 or later.
</p>
<a name="tpmtool-usage"></a><a name="tpmtool-help_002fusage-_0028_002d_002dhelp_0029"></a>
<h4 class="subsection">5.4.5 tpmtool help/usage (<samp>--help</samp>)</h4>
<a name="index-tpmtool-help"></a>
<p>This is the automatically generated usage text for tpmtool.
</p>
<p>The text printed is the same whether selected with the <code>help</code> option
(<samp>--help</samp>) or the <code>more-help</code> option (<samp>--more-help</samp>). <code>more-help</code> will print
the usage text by passing it through a pager program.
<code>more-help</code> is disabled on platforms without a working
<code>fork(2)</code> function. The <code>PAGER</code> environment variable is
used to select the program, defaulting to <samp>more</samp>. Both will exit
with a status code of 0.
</p>
<div class="example">
<pre class="example">tpmtool - GnuTLS TPM tool
Usage: tpmtool [ -<flag> [<val>] | --<name>[{=| }<val>] ]...
-d, --debug=num Enable debugging
- it must be in the range:
0 to 9999
--infile=file Input file
- file must pre-exist
--outfile=str Output file
--generate-rsa Generate an RSA private-public key pair
--register Any generated key will be registered in the TPM
- requires the option 'generate-rsa'
--signing Any generated key will be a signing key
- requires the option 'generate-rsa'
-- and prohibits the option 'legacy'
--legacy Any generated key will be a legacy key
- requires the option 'generate-rsa'
-- and prohibits the option 'signing'
--user Any registered key will be a user key
- requires the option 'register'
-- and prohibits the option 'system'
--system Any registred key will be a system key
- requires the option 'register'
-- and prohibits the option 'user'
--pubkey=str Prints the public key of the provided key
--list Lists all stored keys in the TPM
--delete=str Delete the key identified by the given URL (UUID).
--test-sign=str Tests the signature operation of the provided object
--sec-param=str Specify the security level [low, legacy, medium, high, ultra].
--bits=num Specify the number of bits for key generate
--inder Use the DER format for keys.
- disabled as '--no-inder'
--outder Use DER format for output keys
- disabled as '--no-outder'
-v, --version[=arg] output version information and exit
-h, --help display extended usage information and exit
-!, --more-help extended usage information passed thru pager
Options are specified by doubled hyphens and their name or by a single
hyphen and the flag character.
Program that allows handling cryptographic data from the TPM chip.
</pre></div>
<a name="tpmtool-debug"></a><a name="debug-option-_0028_002dd_0029"></a>
<h4 class="subsection">5.4.6 debug option (-d)</h4>
<p>This is the “enable debugging” option.
This option takes a number argument.
Specifies the debug level.
<a name="tpmtool-generate_002drsa"></a></p><a name="generate_002drsa-option"></a>
<h4 class="subsection">5.4.7 generate-rsa option</h4>
<p>This is the “generate an rsa private-public key pair” option.
Generates an RSA private-public key pair in the TPM chip.
The key may be stored in filesystem and protected by a PIN, or stored (registered)
in the TPM chip flash.
<a name="tpmtool-user"></a></p><a name="user-option"></a>
<h4 class="subsection">5.4.8 user option</h4>
<p>This is the “any registered key will be a user key” option.
</p>
<p>This option has some usage constraints. It:
</p><ul>
<li> must appear in combination with the following options:
register.
</li><li> must not appear in combination with any of the following options:
system.
</li></ul>
<p>The generated key will be stored in a user specific persistent storage.
<a name="tpmtool-system"></a></p><a name="system-option"></a>
<h4 class="subsection">5.4.9 system option</h4>
<p>This is the “any registred key will be a system key” option.
</p>
<p>This option has some usage constraints. It:
</p><ul>
<li> must appear in combination with the following options:
register.
</li><li> must not appear in combination with any of the following options:
user.
</li></ul>
<p>The generated key will be stored in system persistent storage.
<a name="tpmtool-test_002dsign"></a></p><a name="test_002dsign-option"></a>
<h4 class="subsection">5.4.10 test-sign option</h4>
<p>This is the “tests the signature operation of the provided object” option.
This option takes a string argument <samp>url</samp>.
It can be used to test the correct operation of the signature operation.
This operation will sign and verify the signed data.
<a name="tpmtool-sec_002dparam"></a></p><a name="sec_002dparam-option"></a>
<h4 class="subsection">5.4.11 sec-param option</h4>
<p>This is the “specify the security level [low, legacy, medium, high, ultra].” option.
This option takes a string argument <samp>Security parameter</samp>.
This is alternative to the bits option. Note however that the
values allowed by the TPM chip are quantized and given values may be rounded up.
<a name="tpmtool-inder"></a></p><a name="inder-option"></a>
<h4 class="subsection">5.4.12 inder option</h4>
<p>This is the “use the der format for keys.” option.
</p>
<p>This option has some usage constraints. It:
</p><ul>
<li> can be disabled with –no-inder.
</li></ul>
<p>The input files will be assumed to be in the portable
DER format of TPM. The default format is a custom format used by various
TPM tools
<a name="tpmtool-outder"></a></p><a name="outder-option"></a>
<h4 class="subsection">5.4.13 outder option</h4>
<p>This is the “use der format for output keys” option.
</p>
<p>This option has some usage constraints. It:
</p><ul>
<li> can be disabled with –no-outder.
</li></ul>
<p>The output will be in the TPM portable DER format.
<a name="tpmtool-exit-status"></a></p><a name="tpmtool-exit-status-1"></a>
<h4 class="subsection">5.4.14 tpmtool exit status</h4>
<p>One of the following exit values will be returned:
</p><dl compact="compact">
<dt>‘<samp>0 (EXIT_SUCCESS)</samp>’</dt>
<dd><p>Successful program execution.
</p></dd>
<dt>‘<samp>1 (EXIT_FAILURE)</samp>’</dt>
<dd><p>The operation failed or the command syntax was not valid.
</p></dd>
</dl>
<a name="tpmtool-See-Also"></a><a name="tpmtool-See-Also-1"></a>
<h4 class="subsection">5.4.15 tpmtool See Also</h4>
<p>p11tool (1), certtool (1)
<a name="tpmtool-Examples"></a></p><a name="tpmtool-Examples-1"></a>
<h4 class="subsection">5.4.16 tpmtool Examples</h4>
<p>To generate a key that is to be stored in filesystem use:
</p><div class="example">
<pre class="example">$ tpmtool --generate-rsa --bits 2048 --outfile tpmkey.pem
</pre></div>
<p>To generate a key that is to be stored in TPM’s flash use:
</p><div class="example">
<pre class="example">$ tpmtool --generate-rsa --bits 2048 --register --user
</pre></div>
<p>To get the public key of a TPM key use:
</p><div class="example">
<pre class="example">$ tpmtool --pubkey tpmkey:uuid=58ad734b-bde6-45c7-89d8-756a55ad1891;storage=user \
--outfile pubkey.pem
</pre></div>
<p>or if the key is stored in the filesystem:
</p><div class="example">
<pre class="example">$ tpmtool --pubkey tpmkey:file=tmpkey.pem --outfile pubkey.pem
</pre></div>
<p>To list all keys stored in TPM use:
</p><div class="example">
<pre class="example">$ tpmtool --list
</pre></div>
<hr>
<div class="header">
<p>
Previous: <a href="Using-keys.html#Using-keys" accesskey="p" rel="prev">Using keys</a>, Up: <a href="Trusted-Platform-Module.html#Trusted-Platform-Module" accesskey="u" rel="up">Trusted Platform Module</a> [<a href="index.html#SEC_Contents" title="Table of contents" rel="contents">Contents</a>][<a href="Function-and-Data-Index.html#Function-and-Data-Index" title="Index" rel="index">Index</a>]</p>
</div>
</body>
</html>
|
