NVME-KEYS-IMPORT(1)

📦 version 3.2, in arch rolling

💖 nvme-keys-import — bestie's guide to importing keys ✨

okay so this is a page from the NVMe Manual, and it's all about nvme-keys-import(1) — the glow-up command that imports NVMeoF TLS PSKs or KX-HMAC-CHAP secrets into a keyring. let's get into it 🫶

🌸 SYNOPSIS 🌸

like, here's the whole vibe in one block:

nvme [<global-options>] keys import [--keyring=<name> | -k <name>]
                        [--keyfile=<file> | -f <file>]
                        [--keydata=<key> | -d <key>]
                        [--identity=<identity> | -i <identity>]

that's it. that's the whole thing. no cap 💅

✨ DESCRIPTION ✨

so this command imports one or more already-identified keys into a keyring. bestie, the key type is auto-detected from the key's prefix — either NVMeTLSkey-1: (TLS PSK) or DHHC-1: (KX-HMAC-CHAP host secret). it just knows. main character energy fr 🔥

📥 bulk mode (no --identity)

without --identity, keys are read in bulk. the key data is read in this form:

<description> <key>

where <description> is the key description — like, the TLS PSK identity for a TLS PSK — and <key> is either:

  • a TLS PSK in interchange format NVMeTLSkey-1:<hmac>:<base64 encoded data>:, or
  • a KX-HMAC-CHAP secret in the form DHHC-1:<hmac>:<base64 encoded data>:

one key per line, and they get imported into the kernel keyring. this is the exact format produced by nvme-keys-export(1), so it's giving round-trip 🎀

🎯 single-key mode (with --identity)

with --identity, a single key is imported instead: the key is read from --keydata (or, if that's not given, from stdin) and stored under the given identity. this is the way to insert a single KX-HMAC-CHAP secret, or a previously derived TLS PSK, directly by identity — no keyfile needed. lowkey convenient 🦋

⚠️ heads up: this command does not derive a TLS PSK from a configured PSK, and it does not compute the identity to store it under from a host/subsystem NQN pair. for that, use nvme-keys-insert-tls-psk(1). different command, different job, iykyk 😭

🎀 OPTIONS 🎀

  • -k <name>, --keyring=<name> — the name of the keyring you're importing the keys into. default is .nvme. yes, with the dot. iconic.
  • -f <file>, --keyfile=<file> — file to read the keys from instead of stdin. only used in bulk mode (i.e. when --identity is not given). slay.
  • -d <key>, --keydata=<key> — the key to be inserted when --identity is given. if you don't give it, the key is read from stdin. 🍓
  • -i <identity>, --identity=<identity> — identity to store a single key under. if given, --keydata (or stdin) is read as a single key instead of a bulk <description> <key> list. periodt.

🌈 GLOBAL OPTIONS 🌈

these ones live at the top-level nvme command and are available to this subcommand too. so you can absolutely use them here 💜

  • --dry-run — print the command that would be executed, but don't actually execute it. like a little dress rehearsal 🧚
  • --no-ioctl-probing — disable probing for 64-bit IOCTL support.
  • --no-retries — disable retry logic on transient errors. one shot, no takebacks.
  • -o <fmt>, --output-format=<fmt> — set the reporting format to normal, tabular, 'json, or binary. only one output format may be used at a time, bestie. pick one. 💅
  • --output-format-version=<version> — select the output format version. version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names. other versions are rejected. rude but fair.
  • --quiet — suppress informational messages. errors are still reported, and --quiet cancels any --verbose for the library log level. shhh 🤫
  • --set-options=<key=value>[,<key=value>...] — set libnvme library options for this invocation. supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir.
  • --timeout=<ms> — set the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). no clock, no stress ⭐
  • -v, --verbose — increase the level of detail in the output. may be specified multiple times to further increase verbosity. go off, be as verbose as you want 🗣️

these options can also be set as machine-wide defaults in nvme-cli.conf(5). a command-line flag always overrides the file. always. 👑

🔥 EXAMPLES 🔥

1. import previously exported keys from a file and verify with keyctl

# nvme keys import -f nvme-tls-keys.txt

# keyctl show
Session Keyring
 573249525 --alswrv      0     0  keyring: _ses
 353599402 --alswrv      0 65534   \_ keyring: _uid.0
 475911922 ---lswrv      0     0   \_ keyring: .nvme
 734343968 --als-rv      0     0       \_ psk: NVMe0R01 hostnqn0 subsys0

look at that tree. beautiful. the little psk: baby at the bottom? that's your key. ate and left no crumbs 😭💖

2. import a single KX-HMAC-CHAP secret under an explicit identity

# nvme keys import -i host2 -d DHHC-1:00:ia6zGodOr4SEG0Zzaw398rpY0wqipUWj4jWjUh4HWUz6aQ2n:

one key, one identity, zero drama. that's the whole move 🦋

👑 NVME 👑

part of the nvme-user suite. you're in good company, bestie 💜

and that's the page!! written by the NVMe crew, dated 10/30/2026, and rendered right back at you as NVME-KEYS-IMPORT(1). go forth and import those keys — you're literally gonna slay ✨🎀💅

📦 where this page comes from