stpm-exfiltrate(1)

💅 stpm-exfiltrate — the manual page, bestie edition

okay so you found stpm-exfiltrate(1), the little tool from the simple-tpm-pk11 family, and you're like "what does this even do" — don't worry, I got you. sit down, hydrate, let's go. 🫶

✨ NAME ✨

stpm-exfiltrate — Extract key from TPM chip 🔑

🌸 SYNOPSIS 🌸

stpm-exfiltrate [ -hOps ] -k key file

💖 DESCRIPTION 💖

stpm-exfiltrate extracts a key that is otherwise protected by the TPM chip. lowkey iconic of it, ngl.

BUT — and this is the plot twist — it only works if the key is "migratable" (meaning it was generated in software), and the TPM owner password is known. both. you need both. no cap.

which is exactly why you should generate keys in hardware (the default) with stpm-keygen and not use its -S option. fr fr. hardware keys = main character energy, software keys = the vibe check they fail. 😭

✨ OPTIONS ✨

• -h — Show usage info. your classic little "help me" button 💅
• -k key file — Key blob file to read. this is the key file, you're reading it, that's the whole thing 🎀
• -O — Use Well Known Secret for owner password. Default is ask. so like, if you don't pass this, it's gonna ask you. 🙈
• -p — Ask for key PIN / password. Default is Well Known Secret. note the flip-flop bestie, this one's the opposite of -O 👑
• -o — Ask for SRK PIN / password. Default is Well Known Secret. same deal, but for the SRK 🌸

🦋 EXAMPLES 🦋

the classic, just hand over the key file:

stpm-exfiltrate -k ~/.simple-tpm-pk11/my.key
Enter owner password: blah blah
[ ... key data here ...]

now with a key PIN, because you're being a little extra (affectionate):

stpm-exfiltrate -p -k ~/.simple-tpm-pk11/my.key
Enter owner password: blah blah
Enter key PIN: my secret password here
[ ... key data here ...]

and the full serve, owner password and key PIN and SRK PIN, she ate:

stpm-exfiltrate -sp -k ~/.simple-tpm-pk11/my.key
Enter owner password: blah blah
Enter key PIN: my secret password here
Enter SRK PIN: 12345678
[ ... key data here ...]

💀 DIAGNOSTICS 💀

Most errors will probably be related to interacting with the TPM chip. like, it's almost always the chip, it's never you (it's sometimes you). Resetting the TPM chip and taking ownership should take care of most of them. See the TPM-TROUBLESHOOTING section of simple-tpm-pk11(7). go read it, it's giving helpful. 🧚

⭐ SEE ALSO ⭐

simple-tpm-pk11(7), stpm-sign(1), stpm-keygen.

🌈 AUTHOR 🌈

Simple-TPM-PK11 was written By Thomas Habets <habets@google.com> / <thomas@habets.se>.

git clone https://github.com/ThomasHabets/simple-tpm-pk11.git

and that's the whole page, bestie 🎀 — this one's from simple-tpm-pk11, dated 16th Febrary, 2014, and yeah I'm keeping that spelling exactly, it's not mine to fix 💜