tss2_exportkey(1)

💅 tss2_exportkey(1) — like, the whole manual, bestie

okay so this is tss2_exportkey(1), straight out of the General Commands Manual section, and I'm gonna walk you through it like we're texting at 2am 🫶

---

✨ NAME ✨

tss2_exportkey(1) — that's it, that's the name. The OG page literally just leaves the description blank, iconic behavior honestly 💀

---

✨ SYNOPSIS ✨

tss2_exportkey [OPTIONS]

that's the whole vibe. just the command and then whatever options you feel like sprinkling on top 🌸

---

🦋 SEE ALSO 🦋

• fapi-config(5) — go here to adjust Fapi parameters, like which cryptographic profile is being used, the TCTI, or the directories for the Fapi metadata storages. very "settings app" of it 💖
• fapi-profile(5) — go here to figure out the cryptographic algorithms and parameters for all keys and operations of a specific TPM interaction. that means the name hash algorithm, the asymmetric signature algorithm, scheme and parameters, and the PCR bank selection. yeah it's a lot, it's giving "options menu" ✨

---

💜 DESCRIPTION 💜

so tss2_exportkey(1) — the main character — duplicates a key and encrypts it using the public key of a new parent. yes bestie, it re-wraps the key 🔥

the exported data contains the re-wrapped key that pathOfKeyToDuplicate points to, and then the JSON encoded policy after it. the encryption is done according to the TPM encryption schemes specified in the cryptographic profile (cf., fapi-profile(5)). so like, it's not freestyling the crypto — it's following the profile's rules 👑

---

🌈 OPTIONS 🌈

these are the available options, and yes we're doing all of them:

• -e, --pathToPublicKeyOfNewParent=STRING — the path to the public key of the new parent 🍼 this key MAY be in the public key hierarchy /ext. it's an optional parameter. if you omit it, only the public key gets exported. no cap.
• -f, --force — force overwriting the output file. respectfully, it will absolutely clobber what's there 💀
• -o, --exportedData=FILENAME or - (for stdout) — returns the exported subtree. and yes, - means it goes straight to stdout, cute 🎀
• -p, --pathOfKeyToDuplicate=STRING — the path to the root of the subtree to export 🌳

---

⭐ COMMON OPTIONS ⭐

this collection of options are common to all tss2 programs, and they provide information that many users may expect. like, the standard-issue stuff every tss2 tool comes with 💅

• -h, --help [man|no-man] — display the tool's manpage. by default it attempts to invoke the manpager for the tool, but on failure it'll output a short tool summary instead. that's the same behavior you get if you pass the man option argument — however, if explicit man is requested, the tool will provide errors from man on stderr. and if the no-man option is specified, or the manpager fails, the short options get output to stdout. to successfully use the manpages feature you need the manpages installed or on MANPATH, see man(1) for more details 📖
• -v, --version — display version information for this tool, the supported tctis, and exit. quick little vibe check then she's out 🦋

---

🍓 EXAMPLE 🍓

tss2_exportkey --pathOfKeyToDuplicate=HS/SRK/myRSADecrypt --exportedData=exportedData.file

look at her go, ate and left no crumbs 👑

---

🧚 RETURNS 🧚

0 on success or 1 on failure. binary queen, no in-between 😭

---

💀 BUGS 💀

Github Issues. that's literally the whole section. go file one if something's cursed 🙈

---

🫶 HELP 🫶

See the Mailing List. the elders are there, they know things 💜

---

🌸 License 🌸

this work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0) — share responsibly bestie ✨

---

so that's the whole thing!! courtesy of tpm2-tools, dated APRIL 2019, and yeah the page footer still says tss2_exportkey(1) because she's consistent like that 🎀 ily, go export some keys 💖