CREATELOADED(1)

createloaded(1) — that's her, section 1, filed under User Commands, and she is about to become your entire personality. 💅✨

✨ NAME ✨

createloaded — Runs TPM2_CreateLoaded. that's the job. that's the whole job. she ate and left no crumbs 🫶

---

🌸 DESCRIPTION 🌸

ok bestie, before we do literally anything else, the page needs you to sit down and hear this: --version-string=v1045 is not a valid option. not a typo, not a sneaky hidden feature, not a secret level. it's giving "no." 🙈

then she says her own name again — createloaded — and then, one more time, what she does: Runs TPM2_CreateLoaded.

and then? flags. so many flags. buckle up, we're going in 🌈

• -hp — the parent handle, and yes bestie, it can be a hierarchy 💫
  • 40000001 → Owner
  • 4000000c → Platform
  • 4000000b → Endorsement
• [Asymmetric Key Algorithm] — pick your algorithm, main character energy only:
  • -rsa — the default, the safe pick
  • -ecc — curve time 🦋
  • the curves on offer: bnp256, nistp256, nistp384
• Key attributes 👑 — the whole vibe of your key lives down here:
  • -bl — data blob for unseal (create only)
    • -if — data file name
    • -den — decryption, RSA, not storage, NULL scheme
    • -deo — decryption, RSA, not storage, OAEP scheme
    • -des — encryption/decryption, AES symmetric
  • -116 — for TPM rev 116 compatibility (the page wraps this one in square brackets, we respect that)
  • -st — storage (and this is the default for primary keys 💖)
    • -si — signing
    • -sir — restricted signing
    • -dau — create unrestricted ECDAA key pair
    • -dar — create restricted ECDAA key pair
    • -kh — keyed hash (hmac)
    • -dp — derivation parent
    • -gp — general purpose, not storage
  • -kt — and yes, it can be specified more than once 😌
    • f — fixedTPM (default for primary keys and derivation parents)
    • p — fixedParent (default for primary keys and derivation parents)
    • nf — no fixedTPM (default for non-primary keys)
    • np — no fixedParent (default for non-primary keys)
  • -da — object is subject to DA protection (default: no)
  • -pol — policy file (default: empty)
  • -uwa — userWithAuth attribute clear (default: set)
  • -nalg — name hash algorithm, one of sha1, sha256, sha384 (default: sha256)
  • -halg — scheme hash algorithm, one of sha1, sha256, sha384 (default: sha256)
  • -der — object's parent is a derivation parent
  • -pwdk — password for the key (default: empty)
  • -pwdp — password for the parent key (default: empty)
  • -opu — public key file name (default: do not save)
  • -opr — private key file name (default: do not save)
  • -opem — public key PEM format file name (default: do not save)
• -se[0-2] — session handle / attributes (default: PWAP)
  • 01 → continue
  • 20 → command decrypt
  • 40 → response encrypt

and then, final boss of the section: --version is not a valid option either. 💀

---

and now — i am not kidding, i would never lie to you — the page does the WHOLE ENTIRE THING AGAIN. same createloaded, same Runs TPM2_CreateLoaded, same every last flag, top to bottom, twice the flavor, zero extra lore. here it is, round two, because i refuse to drop a single crumb 🍓

createloaded

Runs TPM2_CreateLoaded

• -hp — parent handle (can be hierarchy) 💫
  • 40000001 → Owner
  • 4000000c → Platform
  • 4000000b → Endorsement
• [Asymmetric Key Algorithm]
  • -rsa — default
  • -ecc — curve 🦋
  • curves: bnp256, nistp256, nistp384
• Key attributes 👑
  • -bl — data blob for unseal (create only)
    • -if — data file name
    • -den — decryption, RSA, not storage, NULL scheme
    • -deo — decryption, RSA, not storage, OAEP scheme
    • -des — encryption/decryption, AES symmetric
  • -116 — for TPM rev 116 compatibility (in square brackets on the page)
  • -st — storage (default for primary keys 💖)
    • -si — signing
    • -sir — restricted signing
    • -dau — create unrestricted ECDAA key pair
    • -dar — create restricted ECDAA key pair
    • -kh — keyed hash (hmac)
    • -dp — derivation parent
    • -gp — general purpose, not storage
  • -kt — can be specified more than once 😌
    • f — fixedTPM (default for primary keys and derivation parents)
    • p — fixedParent (default for primary keys and derivation parents)
    • nf — no fixedTPM (default for non-primary keys)
    • np — no fixedParent (default for non-primary keys)
  • -da — object subject to DA protection (default: no)
  • -pol — policy file (default: empty)
  • -uwa — userWithAuth attribute clear (default: set)
  • -nalg — name hash algorithm, one of sha1, sha256, sha384 (default: sha256)
  • -halg — scheme hash algorithm, one of sha1, sha256, sha384 (default: sha256)
  • -der — object's parent is a derivation parent
  • -pwdk — password for the key (default: empty)
  • -pwdp — password for the parent key (default: empty)
  • -opu — public key file name (default: do not save)
  • -opr — private key file name (default: do not save)
  • -opem — public key PEM format file name (default: do not save)
• -se[0-2] — session handle / attributes (default: PWAP)
  • 01 → continue
  • 20 → command decrypt
  • 40 → response encrypt
• --version is not a valid option 💀

---

🦋 SEE ALSO 🦋

the full documentation for createloaded is maintained as a Texinfo manual. so if the info and createloaded programs are properly installed at your site, then this:

info createloaded

should give you access to the complete manual. go get your lore, bestie 📖✨

---

ok that's the whole page, and this is my little sign-off: everything above is createloaded, dated July 2017, with CREATELOADED(1) sitting pretty in the footer. that's the tea, periodt 💅💖🌈