tpm2tss-genkey(1)

💅 tpm2tss-genkey — like, the manual page bestie

Ok so this is tpm2tss-genkey(1) from the General Commands Manual — yes it's a section-1 page, yes we're fancy. Buckle up, we're making TPM keys 🎀

---

✨ NAME ✨

tpm2tss-genkey — the icon, the moment, the key generator for tpm2-tss-engine 💫

---

🌸 SYNOPSIS 🌸

tpm2tss-genkey [options] <filename>

---

🦋 DESCRIPTION 🦋

So tpm2tss-genkey literally creates a key inside a TPM 2.0, and that TPM gets connected through the tpm2tss software stack. No cap. 🔥

And the keys it makes? They can be:

• an RSA key, for decryption or signing
• an ECC key, for ECDSA signatures

The tool respects the OPENSSL_CONF option so you can pass engine specific control parameters. If you wanna know the details on openssl config files, go look at man(5) config. iykyk ✨

---

🧚 ARGUMENTS 🧚

tpm2tss-genkey expects a <filename> — that's where the resulting TPM key information gets stored, bestie. Then you can load that file with OpenSSL like this:

openssl pkeyutl -engine tpm2tss -keyform engine -inkey <filename>

Periodt. 💅

---

👑 OPTIONS 👑

• -a <algorithm>, --alg <algorithm> — the public key algorithm, either rsa or ecdsa (default: rsa)
• -c <curve>, --curve <curve> — if you picked ecdsa for alg, this is the curve for the ecc (default: nist_p256)
• -u <file>, --public <file> — the public key (TPM2B_PUBLIC) to be imported. Heads up: this one requires -r 🫶
• -r <file>, --private <file> — the (encrypted) private key (TPM2B_PRIVATE) to be imported. And this one requires -u
• -e <exponent>, --exponent <exponent> — if you picked rsa for alg, this is the exponent for rsa (default: 65537)
• -h, --help — print help, slay
• -o <password>, --ownerpw <password> — password for the owner hierarchy (default: none). Openssl Config control command: SET_OWNERAUTH
• -p <password>, --password <password> — password for the created key (default: none)
• -P <handle>, --parent <handle> — a specific handle for the parent key (default: none)
• -s <keysize>, --keysize <keysize> — if you picked rsa for alg, the key size in bits (default: 2048)
• -v, --verbose — print verbose messages, so you can see what's happening 👀
• -W <password>, --parentpw <password> — password for the parent key (default: none). Openssl Config control command: SET_PARENTAUTH
• -t <tcti-conf>, --tcti <tcti-conf> — TCTI Configuration string (default: none). Openssl Config control command: SET_TCTI

---

🌈 EXAMPLES 🌈

Wanna grab engine info? Do this:

$ openssl engine -t -c tpm2tss

🍓 RSA: make a key, export the pub, encrypt, then decrypt

This little sequence creates an RSA key using the TPM, exports the public key, encrypts a data file, and decrypts it using the TPM:

$ tpm2tss-genkey -a rsa -s 2048 mykey
$ openssl rsa -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub
$ openssl pkeyutl -pubin -inkey mykey.pub -in mydata -encrypt -out mycipher
$ openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -decrypt -in mycipher -out mydata

⭐ RSA: make a key, export the pub, sign, then verify

This one creates an RSA key using the TPM, exports the public key, signs a data file using the TPM, and validates the signature:

$ tpm2tss-genkey -a rsa -s 2048 mykey
$ openssl rsa -engine tpm2tss -inform engine -in mykey -pubout -outform pem -out mykey.pub
$ openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -sign -in mydata -out mysig
$ openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -verify -in mydata -sigfile mysig

💜 ECDSA: make a key, export the pub, sign, then verify

And this one creates an ECDSA key using the TPM, exports the public key, signs a data file using the TPM, and validates the signature:

$ tpm2tss-genkey -a ecdsa -c nist_p256 mykey
$ openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -sign -in mydata -out mysig
$ openssl pkeyutl -engine tpm2tss -keyform engine -inkey mykey -verify -in mydata -sigfile mysig

---

🫶 RETURNS 🫶

0 on success or 1 on failure. That's it, that's the vibe check.

---

🎀 AUTHOR 🎀

Written by Andreas Fuchs. (ty for your service bestie 🙏)

💖 COPYRIGHT 💖

tpm2tss is Copyright (C) 2017-2018 Fraunhofer SIT sponsored by Infineon Technologies AG. License BSD 3-clause.

👀 SEE ALSO 👀

openssl(1) — go read it, it's giving main character energy

---

ok that's the whole page, nothing skipped, no crumbs left behind 💀

This masterpiece is from tpm2-tss-engine, dated OCTOBER 2020 — mwah, stan forever 💋✨