SSH-TPM-ADD(1)

💅 SSH-TPM-ADD 💅

okay so bestie, this is the ssh-tpm-add page from the ssh-tpm-add manual — and honestly? it's giving "tiny tool, huge main character energy." let's get into it 🫶

---

✨ NAME ✨

ssh-tpm-add — the little cutie that adds private keys to the ssh-tpm-agent 🌸

---

🦋 SYNOPSIS 🦋

ssh-tpm-add [-c]

ssh-tpm-add [-c] [PATH ...]

that's it. two whole vibes. pick one 💅

---

💖 DESCRIPTION 💖

so what does ssh-tpm-add actually do? it adds TPM wrapped private keys to ssh-tpm-agent(1) — and yes, that is the whole personality. any keys you pass as arguments get added to the running agent. no cap, that's the job. ✨

it requires the environment variable SSH_TPM_AUTH_SOCK to point at an active UNIX domain socket with an agent listening on it. like, non-negotiable. no socket, no slay. 😭

and if you give it no files at all? it'll try to load the default keys for you, which are ~/.ssh/id_ecdsa.tpm and ~/.ssh/id_rsa.tpm. comfy defaults, we love to see it 🎀

---

🔥 OPTIONS 🔥

• -c — says that the added identities should be subject to confirmation before they get used for authentication. the confirmation is performed by ssh-tpm-agent(1) via SSH_ASKPASS. and here's the important part, bestie: a successful confirmation is signaled by a zero exit status from the askpass program, not by any text entered into the requester. this mirrors ssh-add(1) -c. periodt. 👑

---

🌈 ENVIRONMENT 🌈

• SSH_TPM_AUTH_SOCK — identifies the path of a unix-domain socket for communication with the agent. 🦋

it defaults to /var/tmp/ssh-tpm-agent.sock.

---

🎀 FILES 🎀

• ~/ssh/id_rsa.tpm, ~/ssh/id_ecdsa.tpm — contains the ssh private keys used by ssh-tpm-agent. they are TPM 2.0 TSS key files and are securely wrapped by the TPM. 🔐

lowkey the cool part: they can be shared publicly, because they can only be used by the TPM they were created on. however, it is probably better to not do that. 🙈 just because you can post it doesn't mean you should, yk? vibe check your threat model first.

• ~/ssh/id_rsa.pub, ~/ssh/id_ecdsa.pub — contains the ssh public keys. these ones you genuinely can share publicly, and they're the same format as the ones created by ssh-keygen(1). ⭐

---

🧚 SEE ALSO 🧚

ssh-add(1), ssh-agent(1), ssh(1), ssh-tpm-keygen(1), ssh-keygen(1)

go read your friends, they're iconic too 💜

---

⭐ NOTES, STANDARDS AND OTHER ⭐

the ASN.1 specification for TPM 2.0 key files, for when you're feeling academic:

<https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html>

---

okay that's the whole page!! ty for coming to my ted talk, now go add some keys 🍓✨

— mwah, this was ssh-tpm-agent v0.9.0, dated 2026-08-10, signing off 💖 slay