stpm-sign(1)

📦
version 0.07 · 2 versions
, in nixos 26.05, nixpkgs unstable, ubuntu resolute, ubuntu stonking

✨ stpm-sign(1) ✨

okay bestie so this is stpm-sign, a manual page from section 1 of the simple-tpm-pk11 fam 💅 and it's literally the glow-up your TPM chip needed. let's get into it 🫶

🌸 NAME 🌸

stpm-sign — sign data using the TPM chip 💖

🦋 SYNOPSIS 🦋

stpm-sign [ -hs ] -k key file -f input file

like. that's the whole vibe. flags, key, file, go 🎀

✨ DESCRIPTION ✨

so stpm-sign grabs your SRK-encrypted key blob and is like "hey TPM, sign the contents of input file with this key" and the TPM just… does it 👑

this program is mostly made for debugging — it's the vibe check that makes sure your TPM is set up correctly and that a valid key was actually generated. not me using a whole cryptographic coprocessor to check my homework 😭

💅 OPTIONS 💅

  • -h — show usage info. the classic "wait what were the flags again" button 🙈
  • -f input file — the file containing the data to be signed. this is the main character of the operation fr fr.
  • -k — the key to sign with. heads up bestie: this key is generated with stpm-keygen, so don't come at it with some random file 💀
  • -s — ask for the SRK password interactively. by default the "Well Known Secret" (20 nulls) is used instead. the SRK password is an access token that must be presented for the TPM to perform any operation that involves the TPM — and an actual secret password is usually not required or useful. so like, it's giving formality, not security 🔐✨

🌈 EXAMPLES 🌈

the basic girlie move:

stpm-sign -k ~/.simple-tpm-pk11/my.key -f my-data-here

with a PIN-protected key:

stpm-sign -k ~/.simple-tpm-pk11/my-PIN-key.key -f my-data-here
Enter key PIN: my secret password here

and the full two-step moment, SRK and key PIN:

stpm-sign -sk ~/.simple-tpm-pk11/my-PIN-key.key -f my-data-here
Enter SRK PIN: 12345678
Enter key PIN: my secret password here

slay 💅

🩺 DIAGNOSTICS 🩺

most errors will probably be related to interacting with the TPM chip. ngl that's basically the whole plot.

resetting the TPM chip and taking ownership should take care of most of them 💖

see the TPM-TROUBLESHOOTING section of simple-tpm-pk11(7) for the full rescue arc 🧚

👀 SEE ALSO 👀

simple-tpm-pk11(7), stpm-keygen(1), stpm-verify(1).

🎀 AUTHOR 🎀

Simple-TPM-PK11 was written by Thomas Habets <habets@google.com> / <thomas@habets.se> 👑

git clone https://github.com/ThomasHabets/simple-tpm-pk11.git

okay that's the whole page bestie, no cap 🫶 this was simple-tpm-pk11, dated 1th December, 2013 — iconic behavior, we love to see it. go sign something 💖✨🌸

📦 where this page comes from