NVME-KEYS-GEN-KXC(1)

📦 version 3.2, in arch rolling

💅 NVME-KEYS-GEN-KXC(1) — the nvme-keys-gen-kxchap-secret glow-up ✨

okay so bestie, welcome to the nvme-keys-gen-kxchap-secret page from the NVMe Manual — yes that NVMe, the storage one, and yes this is the cutest little secret-generator you've ever met 🎀

🌸 NAME 🌸

nvme-keys-gen-kxchap-secret — generate a host KX-HMAC-CHAP secret, no cap 💖

✨ SYNOPSIS ✨

nvme [<global-options>] keys gen-kxchap-secret [--hmac=<hmac-id> | -m <hmac-id>]
                        [--secret=<secret> | -s <secret>]
                        [--secret-length=<len> | -l <len>]

like, that's the whole vibe. three optional lil flags, all chill 🦋

💜 DESCRIPTION 💜

So what this does: it generates a KX-HMAC-CHAP secret in the DHHC-1 secret representation — which is defined by the NVM Express Base Specification 2.4, section 8.3.4.5.8 — and it formats it exactly like this:

DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:

and then it prints it to stdout. that's it. that's the whole main character moment 👑 note the trailing colon in the form there — that's part of the look, don't @ me.

🫶 OPTIONS 🫶

  • -m <hmac-id>, --hmac=<hmac-id> — picks the hash function that the consumer is supposed to apply to the secret. the possible values are:
    • 0 — No transformation (the secret is used as the key)
    • 1 — SHA-256
    • 2 — SHA-384
    • 3 — SHA-512
  • -s <secret>, --secret=<secret> — the actual secret value (in hexadecimal) that gets placed in the representation. and if you don't provide one? a random value is used. spontaneous. iconic. 🙈
  • -l <len>, --secret-length=<len> — the length of the secret. possible values are 32, 48, or 64. two things to know, bestie:
    • if you hand it a secret with --secret in hexadecimal, that fixes the length — so a value that contradicts it is an error 💀
    • a secret generated here takes this length, defaulting to the digest size of the selected hash function, or 32 if none is selected. so if you're indecisive, it's got you 🍓

🌈 GLOBAL OPTIONS 🌈

These ones are defined at the top-level nvme command, and they're available to this subcommand too — like the big sisters of the group chat:

  • --dry-run — print the command that would be executed, but don't actually execute it. all talk, no action, we love a preview 💅
  • --no-ioctl-probing — disable probing for 64-bit IOCTL support.
  • --no-retries — disable retry logic on transient errors. one shot, one opportunity.
  • -o <fmt>, --output-format=<fmt> — set the reporting format to normal, tabular, 'json, or binary. only one output format may be used at a time, so pick your fighter ✨ (yes, that apostrophe before json is in the original, we don't fix what isn't ours 🎀)
  • --output-format-version=<version> — select the output format version. version 1 uses the original field naming, while version 2 (the default) provides more consistent and script-friendly field names. other versions are rejected. sorry to those versions 😭
  • --quiet — suppress informational messages. errors are still reported, and --quiet cancels any --verbose for the library log level. the quiet friend who still tells you when something's actually wrong 🦋
  • --set-options=<key=value>[,<key=value>...] — set libnvme library options for this invocation. the supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir.
  • --timeout=<ms> — set the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). patience is a virtue ngl ⭐
  • -v, --verbose — increase the level of detail in the output. may be specified multiple times to further increase verbosity. stack 'em like bracelets 💖
Also important: these options can be set as machine-wide defaults in nvme-cli.conf(5), and a command-line flag always overrides the file. flags win, periodt 🏆

🔥 EXAMPLES 🔥

No Examples

(that's genuinely what the page says — the examples section is just vibing empty, and honestly? respect 🧚)

👑 NVME 👑

Part of the nvme-user suite — you're in good company, bestie 💜

and that's the page! this one came from the NVMe crew, dated 10/30/2026, and that's genuinely the whole thing — go generate a secret, you've got this 🌸✨

📦 where this page comes from