1tpm2_rsaencrypt(1)          General Commands Manual         tpm2_rsaencrypt(1)
2
3
4

NAME

6       tpm2_rsaencrypt(1)  -  Performs  an  RSA Encryption operation using the
7       TPM.
8

SYNOPSIS

10       tpm2_rsaencrypt [OPTIONS] FILE
11

DESCRIPTION

13       tpm2_rsaencrypt(1) performs RSA encryption on the contents of FILE (de‐
14       faulting to stdin) using the indicated padding scheme according to IETF
15       RFC 3447 (PKCS#1).  The scheme of keyHandle should not be TPM_ALG_NULL.
16
17       The key referenced by keyHandle is required to be:
18
19       1. an RSA key
20
21       2. Have the attribute decrypt SET in it's attributes.
22

OPTIONS

24       · -k, –key-handle=KEY_HANDLE:
25
26         the public portion of RSA key to use for encryption.
27
28       · -c, –key-context=KEY_CONTEXT_FILE:
29
30         filename of the key context used for the operation.
31
32       · -P, –pwdk=KEY_PASSWORD:
33
34         specifies the password of KEY_HANDLE.  Passwords  should  follow  the
35         password formatting standards, see section “Password Formatting”.
36
37       · -o, –out-file=OUTPUT_FILE:
38
39         Output file path, record the decrypted data.  The default is to print
40         an xxd compatible hexdump to stdout.  If a file is specified, raw bi‐
41         nary output is performed.
42
43       · -S, –input-session-handle=SESSION_HANDLE:
44
45         Optional  Input  session  handle from a policy session for authoriza‐
46         tion.
47

COMMON OPTIONS

49       This collection of options are common to many programs and provide  in‐
50       formation that many users may expect.
51
52       · -h,  –help: Display the tools manpage.  This requires the manpages to
53         be installed or on MANPATH, See man(1) for more details.
54
55       · -v, –version: Display version information for  this  tool,  supported
56         tctis and exit.
57
58       · -V,  –verbose:  Increase  the information that the tool prints to the
59         console during its execution.  When using this option  the  file  and
60         line number are printed.
61
62       · -Q, –quiet: Silence normal tool output to stdout.
63
64       · -Z,  –enable-errata: Enable the application of errata fixups.  Useful
65         if an errata fixup needs to be applied to commands sent to  the  TPM.
66         # TCTI ENVIRONMENT
67
68       This  collection of environment variables that may be used to configure
69       the various TCTI modules available.
70
71       The values passed through  these  variables  can  be  overridden  on  a
72       per-command basis using the available command line options, see the TC‐
73       TI_OPTIONS section.
74
75       The variables respected depend on how the software was configured.
76
77       · TPM2TOOLS_TCTI_NAME: Select the TCTI used for communication with  the
78         next  component down the TSS stack.  In most configurations this will
79         be the TPM but it could be a simulator or proxy.  The  current  known
80         TCTIs are:
81
82         · tabrmd    -    The    new    resource    manager,   called   tabrmd
83           (https://github.com/01org/tpm2-abrmd).
84
85         · socket - Typically used with the old resource manager,  or  talking
86           directly to a simulator.
87
88         · device - Used when talking directly to a TPM device file.
89
90       · TPM2TOOLS_DEVICE_FILE:  When  using  the device TCTI, specify the TPM
91         device file.  The default is “/dev/tpm0”.
92
93         Note: Using the tpm directly requires the users to ensure  that  con‐
94         current access does not occur and that they manage the tpm resources.
95         These tasks are usually managed by a resource  manager.   Linux  4.12
96         and  greater  supports an in kernel resource manager at “/dev/tpmrm”,
97         typically “/dev/tpmrm0”.
98
99       · TPM2TOOLS_SOCKET_ADDRESS: When using the socket TCTI, specify the do‐
100         main name or IP address used.  The default is 127.0.0.1.
101
102       · TPM2TOOLS_SOCKET_PORT:  When  using the socket TCTI, specify the port
103         number used.  The default is 2321.
104

TCTI OPTIONS

106       This collection of options are used to configure the varous  TCTI  mod‐
107       ules available.  They override any environment variables.
108
109       · -T, –tcti=TCTI_NAME[:TCTI_OPTIONS]: Select the TCTI used for communi‐
110         cation with the next component down the TSS stack.  In most  configu‐
111         rations    this    will    be    the    resource    manager:   tabrmd
112         (https://github.com/01org/tpm2-abrmd) Optionally, tcti  specific  op‐
113         tions can appended to TCTI_NAME by appending a : to TCTI_NAME.
114
115         · For the device TCTI, the TPM device file for use by the device TCTI
116           can be specified.  The  default  is  /dev/tpm0.   Example:  -T  de‐
117           vice:/dev/tpm0
118
119         · For  the socket TCTI, the domain name or IP address and port number
120           used by the socket can be specified.  The default are 127.0.0.1 and
121           2321.  Example: -T socket:127.0.0.1:2321
122
123         · For the abrmd TCTI, it takes no options.  Example: -T abrmd
124

Password Formatting

126       Passwords  are  interpreted  in  two  forms,  string and hex-string.  A
127       string password is not interpreted, and is directly used for authoriza‐
128       tion.   A  hex-string, is converted from a hexidecimal form into a byte
129       array form, thus allowing passwords with non-printable and/or  terminal
130       un-friendly characters.
131
132       By  default  passwords  are assumed to be in the string form.  Password
133       form is specified with special prefix values, they are:
134
135       · str: - Used to indicate it is a raw string.  Useful  for  escaping  a
136         password that starts with the “hex:” prefix.
137
138       · hex: - Used when specifying a password in hex string format.
139

EXAMPLES

141              tpm2_rsaencrypt -k 0x81010001 -o encrypted.out plain.in
142

RETURNS

144       0 on success or 1 on failure.
145

BUGS

147       Github Issues (https://github.com/01org/tpm2-tools/issues)
148

HELP

150       See the Mailing List (https://lists.01.org/mailman/listinfo/tpm2)
151
152
153
154tpm2-tools                      SEPTEMBER 2017              tpm2_rsaencrypt(1)