stpm-keygen(1)

✨ stpm-keygen ✨

okay bestie, welcome to stpm-keygen, part of the simple-tpm-pk11 family 💖

---

💫 NAME 💫

stpm-keygen — generate a key pair for use with simple-tpm-pk11 🔑✨

---

🎀 SYNOPSIS 🎀

stpm-keygen [ -hps ] -o output file

---

🦋 DESCRIPTION 🦋

so like. stpm-keygen generates a 2048 RSA key inside the TPM chip, and saves the public key plus the SRK-encrypted private key (that's the "blob", iykyk) into the output file. that's it. that's the whole vibe. 💅

---

🌸 OPTIONS 🌸

• -h — show usage info. help me help you, bestie 🫶
• -o output file — the output file, where the public key and the key blob get written. this one's not optional, no cap.
• -p — create the key with a PIN / password. the password gets prompted for interactively ✨
• -s — ask for the SRK password interactively. by default the "Well Known Secret" (that's 20 nulls) is used. the SRK password is an access token that has to be presented for the TPM to perform any operation that involves the TPM, and an actual secret password is usually not required or useful. so like, mostly it's just vibes 😌
• -S — generate the key in software instead of hardware. and bestie, the choice between generating in software vs hardware is not an obvious one, fr fr. it's hard to verify the quality of keys generated in hardware (bugs? backdoors? 🙈), but software keys have existed in RAM at some point. and because software generated keys have to be generated as migratable keys, they can be extracted by someone who knows the TPM owner password. 😭 so the recommended choice is to generate in hardware — which is also the default. slay 👑

---

🌈 EXAMPLES 🌈

the classic:

stpm-keygen -o ~/.simple-tpm-pk11/my.key

with a PIN:

stpm-keygen -p -o ~/.simple-tpm-pk11/my.key
Enter key PIN: my secret password here

with both the SRK PIN and the key PIN:

stpm-keygen -sp -o ~/.simple-tpm-pk11/my.key
Enter SRK PIN: 12345678
Enter key PIN: my secret password here

---

💀 DIAGNOSTICS 💀

most errors will probably be related to interacting with the TPM chip. 😩 resetting the TPM chip and taking ownership should take care of most of them. see the TPM-TROUBLESHOOTING section of simple-tpm-pk11(7). go read it, bestie, it's giving lifesaver 🫶

---

👑 SEE ALSO 👑

• simple-tpm-pk11(7)
• stpm-sign(1)
• http://blog.habets.se/2013/11/Should-I-generate-my-keys-in-software-or-hardware

---

💜 AUTHOR 💜

Simple-TPM-PK11 was written By Thomas Habets <habets@google.com> / <thomas@habets.se>.

git clone https://github.com/ThomasHabets/simple-tpm-pk11.git

---

okay that's the whole page, you ate that 💅 this was simple-tpm-pk11, version dated 1th December, 2013 — yes the "1th" is canon, don't come for me 😭 periodt ✨🎀💖