NVME-KEYS-CHECK-K(1)

📦 version 3.2, in arch rolling

💅 NVME-KEYS-CHECK-K(1) — like, the NVMe Manual, bestie ✨

okay so this is a page from the NVMe Manual and it's all about nvme-keys-check-kxchap-secret. yes the page title says NVME-KEYS-CHECK-K(1) and the actual command is nvme-keys-check-kxchap-secret — that's not a typo on my part, that's just how the page is named, don't come for me 🙈

🌸 NAME 🌸

nvme-keys-check-kxchap-secret — checks a host KX-HMAC-CHAP secret, literally that's the whole job 🎀

✨ SYNOPSIS ✨

nvme [<global-options>] keys check-kxchap-secret [--keydata=<secret> | -d <secret>]
                        [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        [--identity=<identity> | -i <identity>]

🦋 DESCRIPTION 🦋

So what this does: it checks whether the string you hand it is a valid KX-HMAC-CHAP host secret, of the form DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n: 💖 and then it prints the hash algorithm it records, the secret length, and the CRC. that's the trio, slay.

If --keydata is not given, the secret gets read from stdin — which also means you can check a secret that's chillin' in a file, like so: nvme keys check-kxchap-secret < keyfile. lowkey convenient ngl.

If --identity is given, the specified keyring also gets checked for a secret already stored under that identity (as inserted by nvme-keys-import(1)), and the result is reported: not loaded, loaded and matching, or loaded but different. And hear me when I say this: this command never modifies the keyring. not once. it's a look-don't-touch situation 👑

⚠️ looking up a secret requires the kxchap keyring key type, and that is not yet provided by any released Linux kernel — so this part is very much a "coming soon" vibe. peep nvme-keys-import(1) for the details, iykyk 😭

💅 OPTIONS 💅

  • -d <secret>, --keydata=<secret> — the secret you want checked. if you don't give it, the secret gets read from stdin 🍓
  • -k <name>, --keyring=<name> — the name of the keyring to check for an already-loaded secret. default is .nvme 🔑
  • -t <type>, --keytype=<type> — the key type of the secret to look up. default is kxchap ✨
  • -i <identity>, --identity=<identity> — the identity to look up in the keyring to check if the secret is already loaded. if you skip this one, only the secret format gets validated, that's it 🎀

🌈 GLOBAL OPTIONS 🌈

These ones live up at the top-level nvme command and yes, they're available to this subcommand too. group effort 🫶

  • --dry-run — prints the command that would be executed, but does not actually execute it. all vibes, zero consequences 💀
  • --no-ioctl-probing — disables probing for 64-bit IOCTL support 🔧
  • --no-retries — disables the retry logic on transient errors. no second chances, periodt ✋
  • -o <fmt>, --output-format=<fmt> — sets the reporting format to normal, tabular, 'json, or binary. only one output format at a time, don't get greedy 💅 (yes, that quote mark in 'json is in the original, copy it exactly, no notes 🙈)
  • --output-format-version=<version> — picks the output format version. version 1 uses the original field naming, while version 2 (the default) gives you more consistent and script-friendly field names. any other versions get rejected, sorry babe 🚫
  • --quiet — suppresses informational messages. errors are still reported, and heads up: --quiet cancels any --verbose for the library log level 🤫
  • --set-options=<key=value>[,<key=value>...] — sets libnvme library options for this invocation. supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir 🛠️
  • --timeout=<ms> — sets the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). she waits forever if you ask nicely ⏳
  • -v, --verbose — increases the level of detail in the output. may be specified multiple times to crank the verbosity even higher 🔥
💡 these options can also be set as machine-wide defaults in nvme-cli.conf(5). a command-line flag always overrides the file — flag wins, no cap 👑

🎀 EXAMPLES 🎀

No Examples 😭 (yeah. that's genuinely what it says. we get nothing. iconic behavior honestly)

👑 NVME 👑

Part of the nvme-user suite 🌟

and that's the whole page bestie!! 🦋 source/version is NVMe, dated 10/30/2026 — go forth and check those KX-HMAC-CHAP secrets, you absolute main character 💖✨💅

📦 where this page comes from