1tpm2_getmanufec(1) General Commands Manual tpm2_getmanufec(1)
2
6 tpm2_getmanufec(1) - Retrieve the Endorsement Credential Certificate
7 for the TPM endorsement key from the TPM manufacturer's endorsement
8 certificate hosting server.
9
11 tpm2_getmanufec [OPTIONS] [URL]
12
14 tpm2_getmanufec(1) - Retrieve the Endorsement Credential Certificate
15 for the TPM endorsement key from the TPM manufacturer's endorsement
16 certificate hosting server.
17
19 · -e, –endorse-passwd=ENDORSE_PASSWORD: specifies current endorse pass‐
20 word (string, optional,default:NULL).
21 · -o, –owner-passwd=OWNER_PASSWORD: specifies current owner password
23 (string, optional,default:NULL).
24 · -P, –ek-passwd=EK_PASSWORD: specifies the EK password when created
26 (string,optional,default:NULL).
27 Passwords should follow the password formatting standards, see sec‐
29 tion “Password Formatting”.
30 · -H, –handle=HANDLE: specifies the handle used to make EK persistent
32 (hex).
33 · -g, –alg=ALGORITHM: specifies the algorithm type of EK. See section
35 “Supported Public Object Algorithms” for a list of supported object
36 algorithms. See section “Algorithm Specifiers” on how to specify an
37 algorithm argument.
38 · -f, –output=FILE: Specifies the file used to save the public portion
40 of EK.
41 · -N, –non-persistent: specifies to readout the EK public without mak‐
43 ing it persistent.
44 · -O, –offline=FILE: Specifies the file that contains an EK retrieved
46 from offline platform that needs to be provisioned.
47 · -E, –ec-cert=EC_CERT_FILE: Specifies the file used to save the En‐
49 dorsement Credentials retrieved from the TPM manufacturer provision‐
50 ing server. Defaults to stdout if not specified.
51 · -U, –SSL_NO_VERIFY: specifies to attempt connecting with the TPM man‐
53 ufacturer provisioning server with SSL_NO_VERIFY option.
54 · -S, –input-session-handle=SESSION_HANDLE: Optional Input session han‐
56 dle from a policy session for authorization.
57
59 This collection of options are common to many programs and provide in‐
60 formation that many users may expect.
61 · -h, –help: Display the tools manpage. This requires the manpages to
63 be installed or on MANPATH, See man(1) for more details.
64 · -v, –version: Display version information for this tool, supported
66 tctis and exit.
67 · -V, –verbose: Increase the information that the tool prints to the
69 console during its execution. When using this option the file and
70 line number are printed.
71 · -Q, –quiet: Silence normal tool output to stdout.
73 · -Z, –enable-errata: Enable the application of errata fixups. Useful
75 if an errata fixup needs to be applied to commands sent to the TPM.
76 # TCTI ENVIRONMENT
77 This collection of environment variables that may be used to configure
79 the various TCTI modules available.
80 The values passed through these variables can be overridden on a
82 per-command basis using the available command line options, see the TC‐
83 TI_OPTIONS section.
84 The variables respected depend on how the software was configured.
86 · TPM2TOOLS_TCTI_NAME: Select the TCTI used for communication with the
88 next component down the TSS stack. In most configurations this will
89 be the TPM but it could be a simulator or proxy. The current known
90 TCTIs are:
91 · tabrmd - The new resource manager, called tabrmd
93 (https://github.com/01org/tpm2-abrmd).
94 · socket - Typically used with the old resource manager, or talking
96 directly to a simulator.
97 · device - Used when talking directly to a TPM device file.
99 · TPM2TOOLS_DEVICE_FILE: When using the device TCTI, specify the TPM
101 device file. The default is “/dev/tpm0”.
102 Note: Using the tpm directly requires the users to ensure that con‐
104 current access does not occur and that they manage the tpm resources.
105 These tasks are usually managed by a resource manager. Linux 4.12
106 and greater supports an in kernel resource manager at “/dev/tpmrm”,
107 typically “/dev/tpmrm0”.
108 · TPM2TOOLS_SOCKET_ADDRESS: When using the socket TCTI, specify the do‐
110 main name or IP address used. The default is 127.0.0.1.
111 · TPM2TOOLS_SOCKET_PORT: When using the socket TCTI, specify the port
113 number used. The default is 2321.
114
116 This collection of options are used to configure the varous TCTI mod‐
117 ules available. They override any environment variables.
118 · -T, –tcti=TCTI_NAME[:TCTI_OPTIONS]: Select the TCTI used for communi‐
120 cation with the next component down the TSS stack. In most configu‐
121 rations this will be the resource manager: tabrmd
122 (https://github.com/01org/tpm2-abrmd) Optionally, tcti specific op‐
123 tions can appended to TCTI_NAME by appending a : to TCTI_NAME.
124 · For the device TCTI, the TPM device file for use by the device TCTI
126 can be specified. The default is /dev/tpm0. Example: -T de‐
127 vice:/dev/tpm0
128 · For the socket TCTI, the domain name or IP address and port number
130 used by the socket can be specified. The default are 127.0.0.1 and
131 2321. Example: -T socket:127.0.0.1:2321
132 · For the abrmd TCTI, it takes no options. Example: -T abrmd
134
136 Passwords are interpreted in two forms, string and hex-string. A
137 string password is not interpreted, and is directly used for authoriza‐
138 tion. A hex-string, is converted from a hexidecimal form into a byte
139 array form, thus allowing passwords with non-printable and/or terminal
140 un-friendly characters.
141 By default passwords are assumed to be in the string form. Password
143 form is specified with special prefix values, they are:
144 · str: - Used to indicate it is a raw string. Useful for escaping a
146 password that starts with the “hex:” prefix.
147 · hex: - Used when specifying a password in hex string format.
149
151 Supported public object algorithms are:
152 · 0x1 or rsa for TPM_ALG_RSA (default).
154 · 0x8 or keyedhash for TPM_ALG_KEYEDHASH.
156 · 0x23 or ecc for TPM_ALG_ECC.
158 · 0x25 or symcipher for TPM_ALG_SYMCIPHER.
160 NOTE: Your TPM may not support all algorithms.
162
164 Options that take algorithms support “nice-names”. Nice names, like
165 sha1 can be used in place of the raw hex for sha1: 0x4. The nice names
166 are converted by stripping the leading TPM_ALG_ from the Algorithm Name
167 field and converting it to lower case. For instance TPM_ALG_SHA3_256
168 becomes sha3_256.
169 The algorithms can be found at: <https://trustedcomputinggroup.org/wp-
171 content/uploads/TCG_Algorithm_Registry_Rev_1.24.pdf>
172
174 When the verbose option is specified, additional curl debugging infor‐
175 mation is provided by setting the curl mode verbose, see:
176 <https://curl.haxx.se/libcurl/c/CURLOPT_VERBOSE.html> for more informa‐
177 tion.
178
180 tpm2_getmanufec -e abc123 -o abc123 -P passwd -H 0x81010001-g 0x01 -O -N -U -E ECcert.bin -f ek.bin https://tpm.manufacturer.com/ekcertserver/
181 tpm2_getmanufec -e 1a1b1c -o 1a1b1c -P 123abc -H 0x81010001-g 0x01 -O -N -U -E ECcert.bin -f ek.bin https://tpm.manufacturer.com/ekcertserver/
182
184 0 on success or 1 on failure.
185
187 Github Issues (https://github.com/01org/tpm2-tools/issues)
188
190 See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
191tpm2-tools AUGUST 2017 tpm2_getmanufec(1)