1tpm2_getpubek(1)            General Commands Manual           tpm2_getpubek(1)
2
3
4

NAME

6       tpm2_getpubek(1) - Generate TCG profile compliant endorsement key.
7

SYNOPSIS

9       tpm2_getpubek [OPTIONS]
10

DESCRIPTION

12       tpm2_getpubek(1)  -  Generate TCG profile compliant endorsement key(en‐
13       dorsement hierarchy primary object), make it persistent  with  give  ek
14       handle,  and  return public EK, if any passwd option is missing, assume
15       NULL.
16
17       Refer       to:       <http://www.trustedcomputinggroup.org/files/stat
18       ic_page_files/7CAA5687-1A4B-B294-D04080D058E86C5F>
19

OPTIONS

21       · -e,  –endorse-passwd=ENDORSE_PASSWORD:  Specifies current endorsement
22         password, defaults to NULL.  Passwords should  follow  the  “password
23         formatting standards, see section”Password Formatting“.
24
25       · -o,  –owner-passwd=OWNER_PASSWORD  Specifies  the current owner pass‐
26         word, defaults to NULL.  Same formatting as the endorse password val‐
27         ue or -e option.
28
29       · -P, –eKPasswd=EK_PASSWORD Specifies the EK password when created, de‐
30         faults to NULL.  Same formatting as the endorse password value or  -e
31         option.
32
33       · -H,  –handle=HANDLE:  specifies the handle used to make EK persistent
34         (hex).
35
36       · -g, –alg=ALGORITHM: specifies the algorithm type of EK.  See  section
37         “Supported  Public  Object Algorithms” for a list of supported object
38         algorithms.  See section “Algorithm Specifiers” on how to specify  an
39         algorithm argument.
40
41       · -f, –file=FILE: specifies the file used to save the public portion of
42         EK.  This will be  a  binary  data  structure  corresponding  to  the
43         TPM2B_PUBLIC struct in the specification.
44
45       · -S, –input-session-handle=SESSION: Optional Input session handle from
46         a policy session for authorization.
47

COMMON OPTIONS

49       This collection of options are common to many programs and provide  in‐
50       formation that many users may expect.
51
52       · -h,  –help: Display the tools manpage.  This requires the manpages to
53         be installed or on MANPATH, See man(1) for more details.
54
55       · -v, –version: Display version information for  this  tool,  supported
56         tctis and exit.
57
58       · -V,  –verbose:  Increase  the information that the tool prints to the
59         console during its execution.  When using this option  the  file  and
60         line number are printed.
61
62       · -Q, –quiet: Silence normal tool output to stdout.
63
64       · -Z,  –enable-errata: Enable the application of errata fixups.  Useful
65         if an errata fixup needs to be applied to commands sent to  the  TPM.
66         # TCTI ENVIRONMENT
67
68       This  collection of environment variables that may be used to configure
69       the various TCTI modules available.
70
71       The values passed through  these  variables  can  be  overridden  on  a
72       per-command basis using the available command line options, see the TC‐
73       TI_OPTIONS section.
74
75       The variables respected depend on how the software was configured.
76
77       · TPM2TOOLS_TCTI_NAME: Select the TCTI used for communication with  the
78         next  component down the TSS stack.  In most configurations this will
79         be the TPM but it could be a simulator or proxy.  The  current  known
80         TCTIs are:
81
82         · tabrmd    -    The    new    resource    manager,   called   tabrmd
83           (https://github.com/01org/tpm2-abrmd).
84
85         · socket - Typically used with the old resource manager,  or  talking
86           directly to a simulator.
87
88         · device - Used when talking directly to a TPM device file.
89
90       · TPM2TOOLS_DEVICE_FILE:  When  using  the device TCTI, specify the TPM
91         device file.  The default is “/dev/tpm0”.
92
93         Note: Using the tpm directly requires the users to ensure  that  con‐
94         current access does not occur and that they manage the tpm resources.
95         These tasks are usually managed by a resource  manager.   Linux  4.12
96         and  greater  supports an in kernel resource manager at “/dev/tpmrm”,
97         typically “/dev/tpmrm0”.
98
99       · TPM2TOOLS_SOCKET_ADDRESS: When using the socket TCTI, specify the do‐
100         main name or IP address used.  The default is 127.0.0.1.
101
102       · TPM2TOOLS_SOCKET_PORT:  When  using the socket TCTI, specify the port
103         number used.  The default is 2321.
104

TCTI OPTIONS

106       This collection of options are used to configure the varous  TCTI  mod‐
107       ules available.  They override any environment variables.
108
109       · -T, –tcti=TCTI_NAME[:TCTI_OPTIONS]: Select the TCTI used for communi‐
110         cation with the next component down the TSS stack.  In most  configu‐
111         rations    this    will    be    the    resource    manager:   tabrmd
112         (https://github.com/01org/tpm2-abrmd) Optionally, tcti  specific  op‐
113         tions can appended to TCTI_NAME by appending a : to TCTI_NAME.
114
115         · For the device TCTI, the TPM device file for use by the device TCTI
116           can be specified.  The  default  is  /dev/tpm0.   Example:  -T  de‐
117           vice:/dev/tpm0
118
119         · For  the socket TCTI, the domain name or IP address and port number
120           used by the socket can be specified.  The default are 127.0.0.1 and
121           2321.  Example: -T socket:127.0.0.1:2321
122
123         · For the abrmd TCTI, it takes no options.  Example: -T abrmd
124

Supported Public Object Algorithms

126       Supported public object algorithms are:
127
128       · 0x1 or rsa for TPM_ALG_RSA (default).
129
130       · 0x8 or keyedhash for TPM_ALG_KEYEDHASH.
131
132       · 0x23 or ecc for TPM_ALG_ECC.
133
134       · 0x25 or symcipher for TPM_ALG_SYMCIPHER.
135
136       NOTE: Your TPM may not support all algorithms.
137

Algorithm Specfiers

139       Options  that  take  algorithms support “nice-names”.  Nice names, like
140       sha1 can be used in place of the raw hex for sha1: 0x4.  The nice names
141       are converted by stripping the leading TPM_ALG_ from the Algorithm Name
142       field and converting it to lower case.  For  instance  TPM_ALG_SHA3_256
143       becomes sha3_256.
144
145       The  algorithms can be found at: <https://trustedcomputinggroup.org/wp-
146       content/uploads/TCG_Algorithm_Registry_Rev_1.24.pdf>
147

EXAMPLES

149              tpm2_getpubek -e abc123 -o abc123 -P passwd -H 0x81010001 -g rsa -f ek.pub
150

RETURNS

152       0 on success or 1 on failure.
153

BUGS

155       Github Issues (https://github.com/01org/tpm2-tools/issues)
156

HELP

158       See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
159
160
161
162tpm2-tools                      SEPTEMBER 2017                tpm2_getpubek(1)
Impressum