NVME-KEYS-EXPORT(1)

📦 version 3.2, in arch rolling

💅 nvme-keys-export — bestie's guide to the NVMe Manual page 🎀

okay so this is nvme-keys-export, and it lives in the NVMe Manual, and it's honestly lowkey iconic: it exports your NVMe TLS PSKs straight out of a keyring. slay.

✨ NAME ✨

nvme-keys-export — export NVMe TLS PSKs from a keyring. that's it, that's the whole vibe 🫶

🌸 SYNOPSIS 🌸

nvme [<global-options>] keys export [--keyring=<name> | -k <name>]
                        [--keyfile=<file> | -f <file>]

so it's the top-level nvme command, then keys export, then your optional flags. very demure, very mindful. 💖

🦋 DESCRIPTION 🦋

okay so what it does: it exports all the NVMe TLS pre-shared keys (PSKs) from the system keyring, and it writes them out in this exact form:

<identity> <psk>

where <identity> is the TLS PSK identity that the key is stored under 😌 and <psk> is the TLS PSK itself, in PSK interchange format:

NVMeTLSkey-1:<hmac>:<base64 encoded data>:

each key gets its own single line. one key, one line, no cap. ✨

now here's the part where you gotta pay attention, bestie, because it's giving "read the label before you use the product" 😭 — the PSK interchange format otherwise carries a configured PSK. it's what nvme-keys-gen-tls-psk(1) prints, and it's what nvme-keys-insert-tls-psk(1) and nvme-keys-check-tls-psk(1) read. but the keys exported here are TLS PSKs instead. so this output is meant for nvme-keys-import(1), which stores each key back under its identity unchanged. it is not intended to be passed to nvme-keys-insert-tls-psk(1) or nvme-keys-check-tls-psk(1). don't do it. i'm literally begging. 🙈

🎀 OPTIONS 🎀

  • -k <name>, --keyring=<name> — the name of the keyring you wanna export the TLS PSKs from. default is .nvme. yes, with the dot. periodt. 💅
  • -f <file>, --keyfile=<file> — a file to write the exported keys to, instead of stdout. because sometimes you want your secrets in a file and not just vibing in your terminal scrollback. 💀

👑 GLOBAL OPTIONS 👑

these are the options defined at the top-level nvme command, and they're all available to this subcommand. the whole squad, basically. 🫶

  • --dry-run — print the command that would be executed, but don't actually execute it. it's giving rehearsal, not the real performance. 🎭
  • --no-ioctl-probing — disable probing for 64-bit IOCTL support.
  • --no-retries — disable retry logic on transient errors. no second chances, no redo. 💀
  • -o <fmt>, --output-format=<fmt> — set the reporting format to normal, tabular, 'json, or binary. only one output format may be used at a time. (yes, the stray quote mark in 'json` is exactly how it's written in the manual — we don't fix, we only report. 🫡)
  • --output-format-version=<version> — select the output format version. version 1 uses the original field naming, while version 2 (the default) provides more consistent and script-friendly field names. other versions are rejected. no notes. ✨
  • --quiet — suppress informational messages. errors are still reported, and --quiet cancels any --verbose for the library log level. so pick a lane, bestie. 🌈
  • --set-options=<key=value>[,<key=value>...] — set libnvme library options for this invocation. supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir.
  • --timeout=<ms> — set the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). patience is a virtue fr fr 🧚
  • -v, --verbose — increase the level of detail in the output. may be specified multiple times to further increase verbosity. the more the merrier 💖
ok and one more thing: these options can also be set as machine-wide defaults in nvme-cli.conf(5). a command-line flag always overrides the file. flags stay winning. 👑

⭐ EXAMPLES ⭐

  • export previously created keys from the kernel keyring and store them into a file 🍓
# nvme keys export -f nvme-tls-keys.txt
  • export/list all keys from the .nvme keyring using nvme and keyctl — look at this little duet, they ate 💅
# nvme keys export
NVMe0R01 hostnqn0 subsys0 NVMeTLSkey-1:01:/b9tVz2OXJVISnoFgrPAygyS86XYJWkAapQeULns6PMpM8wv:

# keyctl show
Session Keyring
 573249525 --alswrv      0     0  keyring: _ses
 353599402 --alswrv      0 65534   \_ keyring: _uid.0
 475911922 ---lswrv      0     0   \_ keyring: .nvme
 649274894 --als-rv      0     0       \_ psk: NVMe0R01 hostnqn0 subsys0

🔥 NVME 🔥

part of the nvme-user suite. main character energy, honestly. 🌟

and that's the whole page bestie!! 💜 this was nvme-keys-export(1) from the NVMe Manual, dated 10/30/2026, and it's part of the nvme-user suite — go export some keys responsibly, mwah 🎀💖✨

📦 where this page comes from