tss2_sign(1)

📦
version 5.8 · 8 versions
, in arch rolling

💅 tss2_sign(1) — General Commands Manual, bestie

Okay so real talk, this is tss2_sign(1), and it's genuinely one of the most useful little tools in the TPM toolbox. Buckle up 🎀

✨ NAME ✨

tss2_sign(1) — yeah that's it, that's the name, the manpage literally just vibes there with a dash and no description, iconic honestly 💀

🦋 SYNOPSIS 🦋

tss2_sign [OPTIONS]

👀 SEE ALSO 👀

Lowkey the most important part, do NOT skip:

  • fapi-config(5) — this one's for adjusting Fapi parameters, like which cryptographic profile gets used, and the TCTI or directories for the Fapi metadata storages.
  • fapi-profile(5) — this one decides the cryptographic algorithms and parameters for all keys and operations of a specific TPM interaction. We're talking the name hash algorithm, the asymmetric signature algorithm, scheme and parameters, and PCR bank selection. That's a lot, but she handles it 💅

🌸 DESCRIPTION 🌸

tss2_sign(1) — okay so here's the tea: this command uses a key inside the TPM to sign a digest value, using the TPM signing schemes as specified in the cryptographic profile (cf., fapi-profile(5)). Periodt.

And the digest? It can be handed to you as an argument directly, OR computed from data you pass as an argument. Your call, bestie 🫶

🎀 OPTIONS 🎀

These are the available options:

  • -p, --keyPath=STRING — the path to the signing key. That's the whole point, no key no sign, iykyk.
  • -s, --padding=STRING — the padding scheme used. Possible values are "RSA_SSA" and "RSA_PSS" (case insensitive, she's flexible like that). This is an optional parameter — if you omit it, the default padding specified in the cryptographic profile gets used (cf., fapi-profile(5)).
  • -c, --certificate=FILENAME or - (for stdout) — the certificate associated with keyPath, in PEM format. Optional parameter ✨
  • -d, --digest=FILENAME or - (for stdin) — the data to be signed, already hashed. Note the "already hashed" part, that's the whole plot twist.
  • -m, --data=FILENAME or - (for stdin) — the data from which the hash is computed, which is then signed. Same energy, different starting point 💖
  • -f, --force — force overwriting the output file. Use responsibly, she's powerful.
  • -k, --publicKey=FILENAME or - (for stdout) — the public key associated with keyPath, in PEM format. Optional parameter 🦋
  • -o, --signature=FILENAME or - (for stdout) — returns the signature in binary form. Binary! Not hex, not base64, binary, okay? 💀

💜 COMMON OPTIONS 💜

This collection of options are common to all tss2 programs and provide information that many users may expect. Like, the standard bestie package:

  • -h, --help [man|no-man] — display the tool's manpage. By default it attempts to invoke the manpager for the tool, however, on failure it will output a short tool summary. Same behavior if the "man" option argument is specified — BUT if explicit "man" is requested, the tool will provide errors from man on stderr. If the "no-man" option is specified, or the manpager fails, the short options will be output to stdout.
Heads up bestie: to successfully use the manpages feature, the manpages need to be installed or on MANPATH. See man(1) for more details. Don't come for her if they're not installed 🙈
  • -v, --version — display version information for this tool, supported tctis, and exit. Quick little vibe check and she's out 💅

🔥 EXAMPLE 🔥

tss2_sign --keyPath=HS/SRK/myRSASign --padding="RSA_PSS" --digest=digest.file --signature=signature.file --publicKey=publicKey.file

Look at her go, ate that fr fr 👑

⭐ RETURNS ⭐

0 on success or 1 on failure. Simple, clean, no surprises. (Well. Mostly.)

💀 BUGS 💀

Github Issues.

🌈 HELP 🌈

See the Mailing List.

👑 License 👑

This work is licensed under the Creative Commons Attribution 4.0 International License (CC BY 4.0).

Kay that's the whole page, mwah 💋 — this was tpm2-tools, APRIL 2019, signing off ✨

📦 where this page comes from