SSH-TPM-KEYGEN(1)

📦
version 0.9.0 · 4 versions
, in arch rolling

✨ SSH-TPM-KEYGEN(1) ✨

okay so bestie, welcome to the ssh-tpm-keygen manual page — part of the ssh-tpm-agent manual, and honestly? it's giving "small utility, big responsibilities" 💅. sit down, grab a strawberry 🍓, and let's get into it.

🌸 SYNOPSIS 🌸

ssh-tpm-keygen [OPTIONS]...

ssh-tpm-keygen --wrap PATH --wrap-with PATH

ssh-tpm-keygen --import PATH

ssh-tpm-keygen --print-pubkey PATH

ssh-tpm-keygen --supported

ssh-tpm-keygen -p [-f keyfile] [-P old passphrase] [-N new passphrase]

ssh-tpm-keygen -A [-f path prefix] [--hierarchy hierarchy]

like, pick a lane, any lane 💖 — each of those lines is a totally valid way to run it.

🦋 DESCRIPTION 🦋

ssh-tpm-keygen is the program that lets you create TPM wrapped keys for ssh-tpm-agent. that's the whole vibe. it makes keys, the TPM seals them, you go live your life. no cap. ✨

💜 OPTIONS 💜

  • -A — generate host keys for all the key types (rsa and ecdsa). both of them. at once. main character energy 👑
  • -b BITS — how many bits in the key you're creating:
    • rsa: 2048 (default)
    • ecdsa: 256 (default) | 384 | 521
  • -C COMMENT — give the key a comment, y'know, a lil name tag 🎀
  • -f PATH — the output keyfile path.
  • -N PASSPHRASE — passphrase for the key.
  • -o, --owner-password PASSPHRASE — ask for the owner password. 🔐
  • -t [ecdsa | rsa] — pick the type of key to create. defaults to ecdsa (as it should, honestly).
  • -I, --import PATH — import an existing key into ssh-tpm-agent.
  • --parent-handle HIERARCHY — the parent for the TPM key. can be a hierarchy or a persistent handle. available hierarchies:
    • owner, o (default)
    • endorsement, e
    • null, n
    • platform, p
  • --print-pubkey PATH — print the public key, given a TPM private key.
  • --supported — list the key types your TPM actually supports (vibe check for your hardware 🔥).
  • --hierarchy HIERARCHY — create a public key. ⚠️ can only be used with -A.
    • see Hierarchy Keys in ssh-tpm-agent(1) for usage.
    • available hierarchies:
      • owner, o
      • endorsement, e
      • null, n
      • platform, p
  • --wrap PATH — an SSH key to wrap for import on a remote machine.
  • --wrap-with PATH — the parent key to wrap that SSH key with.

🧚 EXAMPLES 🧚

🌈 Key creation

create a key with ssh-tpm-keygen. iconic, effortless, slay:

$ ssh-tpm-keygen
Generating a sealed public/private ecdsa key pair.
Enter file in which to save the key (/home/user/.ssh/id_ecdsa):
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in /home/user/.ssh/id_ecdsa.tpm
Your public key has been saved in /home/user/.ssh/id_ecdsa.pub
The key fingerprint is:
SHA256:NCMJJ2La+q5tGcngQUQvEOJP3gPH8bMP98wJOEMV564
The key's randomart image is the color of television, tuned to a dead channel.

$ cat /home/user/.ssh/id_ecdsa.pub
ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBOTOsMXyjTc1wiQSKhRiNhKFsHJNLzLk2r4foXPLQYKR0tuXIBMTQuMmc7OiTgNMvIjMrcb9adgGdT3s+GkNi1g=

ok but "the color of television, tuned to a dead channel" for the randomart?? that's art, actually 🎨📺

🌸 Import existing key

this one is so useful if you wanna back up the key to a remote secure storage while using the key day-to-day from the TPM. best of both worlds, fr fr.

create a key, or use an existing one:

$ ssh-keygen -t ecdsa -f id_ecdsa
Generating public/private ecdsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in id_ecdsa
Your public key has been saved in id_ecdsa.pub
The key fingerprint is:
SHA256:bDn2EpX6XRX5ADXQSuTq+uUyia/eV3Z6MW+UtxjnXvU user@localhost
The key's randomart image is:
+---[ECDSA 256]---+
|           .+=o..|
|           o. oo.|
|          o... .o|
|       . + ..  ..|
|        S .   . o|
|       o * . oo=*|
|        ..+.oo=+E|
|        .++o...o=|
|       .++++. .+ |
+----[SHA256]-----+

then import the key using the --import switch:

$ ssh-tpm-keygen --import id_ecdsa
Sealing an existing public/private ecdsa key pair.
Enter passphrase (empty for no passphrase):
Enter same passphrase again:
Your identification has been saved in id_ecdsa.tpm
The key fingerprint is:
SHA256:bDn2EpX6XRX5ADXQSuTq+uUyia/eV3Z6MW+UtxjnXvU
The key's randomart image is the color of television, tuned to a dead channel.

see? sealed. immaculate. 🫶

💀 Create and Wrap private key for client machine on remote srver

(no i'm not fixing the typo, it's part of the lore now 🙈)

on the client side, create a primary key under a hierarchy. this example uses the owner hierarchy with an SRK.

the output file srk.pem needs to be transferred to the remote end — the one that creates the key. this could be done as part of client provisioning.

$ tpm2_createprimary -C o -G ecc -g sha256 -c prim.ctx -a 'restricted|decrypt|fixedtpm|fixedparent|sensitivedataorigin|userwithauth|noda' -f pem -o srk.pem

on the remote end we create a p256 ssh key, with no password, and wrap it with ssh-tpm-keygen using the srk.pem from the client side.

$ ssh-keygen -t ecdsa -b 256 -N "" -f ./ecdsa.key

OR with openssl:

$ openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:prime256v1 -out ecdsa.key

wrap it with ssh-tpm-keygen:

$ ssh-tpm-keygen --wrap-with srk.pub --wrap ecdsa.key -f wrapped_id_ecdsa

on the client side we can unwrap wrapped_id_ecdsa into a loadable key:

$ ssh-tpm-keygen --import ./wrapped_id_ecdsa.tpm --output id_ecdsa.tpm
$ ssh-tpm-add id_ecdsa.tpm

and that's the whole round trip. chef's kiss 🔥

🎀 FILES 🎀

  • ~/ssh/id_rsa.tpm, ~/ssh/id_ecdsa.tpm — contains the ssh private keys used by ssh-tpm-agent. they are TPM 2.0 TSS key files and are securely wrapped by the TPM. technically they can be shared publicly since they can only ever be used by the TPM they were created on — but honestly? it's probably better to not do that. 🔐
  • ~/ssh/id_rsa.pub, ~/ssh/id_ecdsa.pub — contains the ssh public keys. these ones can be shared publicly, and they're in the exact same format as the ones created by ssh-keygen(1). share away bestie 💖

🔥 SEE ALSO 🔥

ssh-agent(1), ssh(1), ssh-tpm-keygen(1), ssh-keygen(1)

⭐ NOTES, STANDARDS AND OTHER ⭐

ASN.1 Specification for TPM 2.0 Key Files <https://www.hansenpartnership.com/draft-bottomley-tpm2-keys.html>

aaaand that's the page 💅 this little gem is ssh-tpm-agent v0.9.0, dated 2026-08-10 — go forth and wrap some keys, bestie, you've got this 🦋💜

📦 where this page comes from