1tpm2_getpubek(1) General Commands Manual tpm2_getpubek(1)
2
6 tpm2_getpubek(1) - Generate TCG profile compliant endorsement key.
7
9 tpm2_getpubek [OPTIONS]
10
12 tpm2_getpubek(1) - Generate TCG profile compliant endorsement key(en‐
13 dorsement hierarchy primary object), make it persistent with give ek
14 handle, and return public EK, if any passwd option is missing, assume
15 NULL.
16 Refer to: <http://www.trustedcomputinggroup.org/files/stat‐
18 ic_page_files/7CAA5687-1A4B-B294-D04080D058E86C5F>
19
21 · -e, –endorse-passwd=ENDORSE_PASSWORD: Specifies current endorsement
22 password, defaults to NULL. Passwords should follow the “password
23 formatting standards, see section”Password Formatting“.
24 · -o, –owner-passwd=OWNER_PASSWORD Specifies the current owner pass‐
26 word, defaults to NULL. Same formatting as the endorse password val‐
27 ue or -e option.
28 · -P, –eKPasswd=EK_PASSWORD Specifies the EK password when created, de‐
30 faults to NULL. Same formatting as the endorse password value or -e
31 option.
32 · -H, –handle=HANDLE: specifies the handle used to make EK persistent
34 (hex).
35 · -g, –alg=ALGORITHM: specifies the algorithm type of EK. See section
37 “Supported Public Object Algorithms” for a list of supported object
38 algorithms. See section “Algorithm Specifiers” on how to specify an
39 algorithm argument.
40 · -f, –file=FILE: specifies the file used to save the public portion of
42 EK. This will be a binary data structure corresponding to the
43 TPM2B_PUBLIC struct in the specification.
44 · -S, –input-session-handle=SESSION: Optional Input session handle from
46 a policy session for authorization.
47
49 This collection of options are common to many programs and provide in‐
50 formation that many users may expect.
51 · -h, –help: Display the tools manpage. This requires the manpages to
53 be installed or on MANPATH, See man(1) for more details.
54 · -v, –version: Display version information for this tool, supported
56 tctis and exit.
57 · -V, –verbose: Increase the information that the tool prints to the
59 console during its execution. When using this option the file and
60 line number are printed.
61 · -Q, –quiet: Silence normal tool output to stdout.
63 · -Z, –enable-errata: Enable the application of errata fixups. Useful
65 if an errata fixup needs to be applied to commands sent to the TPM.
66 # TCTI ENVIRONMENT
67 This collection of environment variables that may be used to configure
69 the various TCTI modules available.
70 The values passed through these variables can be overridden on a
72 per-command basis using the available command line options, see the TC‐
73 TI_OPTIONS section.
74 The variables respected depend on how the software was configured.
76 · TPM2TOOLS_TCTI_NAME: Select the TCTI used for communication with the
78 next component down the TSS stack. In most configurations this will
79 be the TPM but it could be a simulator or proxy. The current known
80 TCTIs are:
81 · tabrmd - The new resource manager, called tabrmd
83 (https://github.com/01org/tpm2-abrmd).
84 · socket - Typically used with the old resource manager, or talking
86 directly to a simulator.
87 · device - Used when talking directly to a TPM device file.
89 · TPM2TOOLS_DEVICE_FILE: When using the device TCTI, specify the TPM
91 device file. The default is “/dev/tpm0”.
92 Note: Using the tpm directly requires the users to ensure that con‐
94 current access does not occur and that they manage the tpm resources.
95 These tasks are usually managed by a resource manager. Linux 4.12
96 and greater supports an in kernel resource manager at “/dev/tpmrm”,
97 typically “/dev/tpmrm0”.
98 · TPM2TOOLS_SOCKET_ADDRESS: When using the socket TCTI, specify the do‐
100 main name or IP address used. The default is 127.0.0.1.
101 · TPM2TOOLS_SOCKET_PORT: When using the socket TCTI, specify the port
103 number used. The default is 2321.
104
106 This collection of options are used to configure the varous TCTI mod‐
107 ules available. They override any environment variables.
108 · -T, –tcti=TCTI_NAME[:TCTI_OPTIONS]: Select the TCTI used for communi‐
110 cation with the next component down the TSS stack. In most configu‐
111 rations this will be the resource manager: tabrmd
112 (https://github.com/01org/tpm2-abrmd) Optionally, tcti specific op‐
113 tions can appended to TCTI_NAME by appending a : to TCTI_NAME.
114 · For the device TCTI, the TPM device file for use by the device TCTI
116 can be specified. The default is /dev/tpm0. Example: -T de‐
117 vice:/dev/tpm0
118 · For the socket TCTI, the domain name or IP address and port number
120 used by the socket can be specified. The default are 127.0.0.1 and
121 2321. Example: -T socket:127.0.0.1:2321
122 · For the abrmd TCTI, it takes no options. Example: -T abrmd
124
126 Supported public object algorithms are:
127 · 0x1 or rsa for TPM_ALG_RSA (default).
129 · 0x8 or keyedhash for TPM_ALG_KEYEDHASH.
131 · 0x23 or ecc for TPM_ALG_ECC.
133 · 0x25 or symcipher for TPM_ALG_SYMCIPHER.
135 NOTE: Your TPM may not support all algorithms.
137
139 Options that take algorithms support “nice-names”. Nice names, like
140 sha1 can be used in place of the raw hex for sha1: 0x4. The nice names
141 are converted by stripping the leading TPM_ALG_ from the Algorithm Name
142 field and converting it to lower case. For instance TPM_ALG_SHA3_256
143 becomes sha3_256.
144 The algorithms can be found at: <https://trustedcomputinggroup.org/wp-
146 content/uploads/TCG_Algorithm_Registry_Rev_1.24.pdf>
147
149 tpm2_getpubek -e abc123 -o abc123 -P passwd -H 0x81010001 -g rsa -f ek.pub
150
152 0 on success or 1 on failure.
153
155 Github Issues (https://github.com/01org/tpm2-tools/issues)
156
158 See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
159tpm2-tools SEPTEMBER 2017 tpm2_getpubek(1)