NVME-KEYS-INSERT-(1)

📦 version 3.2, in arch rolling

🌸 NAME 🌸

okay so you're looking at nvme-keys-insert-tls-psk and that's the whole vibe of this page ✨ it literally inserts a NVMe TLS PSK into a keyring, bestie. no cap.

✨ SYNOPSIS ✨

the vibe check of how you call it:

nvme [<global-options>] keys insert-tls-psk [--keyring=<name> | -k <name>]
                        [--keytype=<type> | -t <type>]
                        [--hostnqn=<nqn> | -n <nqn>]
                        [--subsysnqn=<nqn> | -c <nqn>]
                        [--keydata=<key> | -d <key>]
                        [--identity=<id-vers> | -I <id-vers>]
                        [--compat | -C]
                        [--keyfile=<keyfile> | -f <keyfile>]

💖 DESCRIPTION 💖

okay so here's the tea: this command takes a NVMe TLS configured PSK in the PSK interchange format NVMeTLSkey-1:<hmac>:<base64-encoded data>:, derives a retained PSK from it and the given host NQN using the HKDF-Expand-Label algorithm from RFC 8446, derives the TLS PSK from that, and stores the result into the specified keyring. like, it's giving ✨ derivation energy ✨

the TLS PSK is stored with the identity NVMe0R<hmac> <host NQN> <subsystem NQN> (for identity version 0) or NVMe1R<hmac> <host NQN> <subsystem NQN> <PSK digest> (for identity version 1). so you know exactly where it lives. iconic.

🚨 bestie, once the TLS PSK is stored in the keyring the configured PSK it was derived from cannot be retrieved from the keyring. like, gone. poof. 💀 so don't lose the original, fr fr.

and the way that both NQNs are inputs to the TLS PSK itself, not just to the identity it's stored under? that's the tea. the host NQN comes in through the retained PSK derivation, and then both NQNs come in again through the identity (identity version 0) or the PSK digest it embeds (identity version 1), which is literally the context of the TLS PSK derivation. no cap.

this command is for deriving a new TLS PSK from a configured PSK; it always needs a subsystem NQN (and, if not given, will look up the host NQN) to derive the TLS PSK and compute the identity to store it under. like, you can't skip the subsystem NQN, bestie. it's required. 🚨

if both the key to store and the identity to store it under are already known—for example a line previously written by nvme-keys-export(1), or a KX-HMAC-CHAP secret—use nvme-keys-import(1) instead, which stores the key as given under an explicit identity, deriving neither. so like, if you already have both, don't use this one, use that one. iykyk.

if --keydata is not given the configured PSK is read from stdin, which also allows reading it from a file, e.g. nvme keys insert-tls-psk -c <subsysnqn> < keyfile. so convenient, bestie. 🫶

to check whether a key is already loaded without inserting it, use nvme-keys-check-tls-psk(1). it's like a vibe check for your keyring. ✨

🎀 OPTIONS 🎀

  • -k <name>, --keyring=<name> — Name of the keyring into which the TLS PSK should be stored. Default is .nvme. so if you don't specify, it goes into .nvme, okay? 💅
  • -t <type>, --keytype=<type> — Type of the key under which the TLS PSK is stored. Default is psk. like, that's the default keytype, bestie.
  • -n <nqn>, --hostnqn=<nqn> — Host NVMe Qualified Name (NQN) to be used for the retained PSK derivation and for the identity the TLS PSK is stored under. Defaults to the host NQN of the system, read from /etc/nvme/hostnqn or, if that file does not exist, generated from the host ID. so it's like, it knows your host NQN, but you can override it. 👑
  • -c <nqn>, --subsysnqn=<nqn> — Subsystem NVMe Qualified Name (NQN) to be used for the identity the TLS PSK is stored under. Required. like, you literally can't skip this one, bestie. 🚨
  • -d <key>, --keydata=<key> — Configured PSK to derive the TLS PSK from. If not given, it is read from stdin. so you can pipe it in, no cap.
  • -I <id-vers>, --identity=<id-vers> — TLS PSK identity version to be used; 0 (the default) is obsolete and defined in the NVMe TCP Transport Specification 1.0, 1 is TLS 1.3 with the PSK digest in the TLS PSK identity. so 0 is like, old news, but it's the default. 1 is the new hotness. 🔥
  • -C, --compat — Use the original non-RFC 8446 compliant algorithm when deriving the retained PSK and the TLS PSK for compatibility with older implementations. like, for the old heads. 👵
  • -f <keyfile>, --keyfile=<keyfile> — Append the identity of the TLS PSK, and the TLS PSK itself in PSK interchange format, to keyfile. so it writes it out for you. cute.

🦋 GLOBAL OPTIONS 🦋

these are defined at the top-level nvme command and are available to this subcommand, so you can use them here too, bestie:

  • --dry-run — Print the command that would be executed, but do not actually execute it. like a dress rehearsal. 🎭
  • --no-ioctl-probing — Disable probing for 64-bit IOCTL support. you know, for the nerds.
  • --no-retries — Disable retry logic on transient errors. so like, no do-overs.
  • -o <fmt>, --output-format=<fmt> — Set the reporting format to normal, tabular, 'json, or binary. Only one output format may be used at a time. yes, that's a stray quote before json—we don't know why, but we respect it. 🙈
  • --output-format-version=<version> — Select the output format version. Version 1 uses the original field naming, while version 2 (default) provides more consistent and script-friendly field names. Other versions are rejected. so v2 is the default and it's the one you want. ⭐
  • --quiet — Suppress informational messages. Errors are still reported, and --quiet cancels any --verbose for the library log level. so it's like, shhh. 🤫
  • --set-options=<key=value>[,<key=value>...] — Set libnvme library options for this invocation. Supported keys are force-4k, mi-probe-enabled, test-base-dir and test-sysfs-dir. you know, for the nerds. 🧚
  • --timeout=<ms> — Set the timeout for the command in milliseconds. infinite or -1 waits without a time limit (0xffffffff). so if you want to wait forever, you can. ⏳
  • -v, --verbose — Increase the level of detail in the output. May be specified multiple times to further increase verbosity. like, the more you say it, the more it says. 🗣️

these options can also be set as machine-wide defaults in nvme-cli.conf(5). A command-line flag always overrides the file. so the file is like the default vibe, but the command line is the main character. 👑

🌈 EXAMPLES 🌈

No Examples. literally none. not a single one. 😭 the manpage says "No Examples" and we respect that.

👑 NVME 👑

Part of the nvme-user suite. periodt. 💅

that's the whole page, bestie! this is from the NVMe manual, dated 10/30/2026, and it's page NVME-KEYS-INSERT-(1). slay, you're welcome 💅✨

📦 where this page comes from