CREATEPRIMARY(1)

👑 NAME

okay so the page is called CREATEPRIMARY(1), it lives in the User Commands manual (section 1, bestie 💅), and the whole thing is about a little program named createprimary.

createprimary — Runs TPM2_CreatePrimary 🫶

---

💖 DESCRIPTION

bestie. sit down. first line of the description and I need you to see it with your own eyes:

--version-string=v1045 is not a valid option

that's it. that's the sentence. it's giving "we're just gonna say that up front". 🙈

anyway, the actual vibe: createprimary creates a primary storage key ✨ and, as established, it Runs TPM2_CreatePrimary.

here's the whole flag situation, exactly as the page spells it out:

• -hi hierarchy (e, o, p, n) — default null
• -pwdp password for hierarchy — default empty
• -pwdpi password file name for hierarchy — default empty
• -pwdk password for key — default empty
• -iu inPublic unique field file — default none
• -opu public key file name — default do not save
• oipem public key PEM format file name — default do not save
• -tk output ticket file name
• -ch output creation hash file name

🔑 Asymmetric Key Algorithm

• -rsa — this one is the default ✨
• -ecc curve

and the curves you can hand it:

• bnp256
• nistp256
• nistp384

🌸 Key attributes

• -bl data blob for unseal (create only)
• -if data file name
• -den — decryption, RSA, not storage, NULL scheme
• -deo — decryption, RSA, not storage, OAEP scheme
• -des — encryption/decryption, AES symmetric
• -116 — for TPM rev 116 compatibility

💜 the storage / purpose girlies

• -st — storage [default for primary keys]
• -si — signing
• -sir — restricted signing
• -dau — create unrestricted ECDAA key pair
• -dar — create restricted ECDAA key pair
• -kh — keyed hash (hmac)
• -dp — derivation parent
• -gp — general purpose, not storage

🎀 attributes, the sequel

• -kt — and yes, it (can be specified more than once) 👀
  • f — fixedTPM (default for primary keys and derivation parents)
  • p — fixedParent (default for primary keys and derivation parents)
  • nf — no fixedTPM (default for non-primary keys)
  • np — no fixedParent (default for non-primary keys)
• -da — object subject to DA protection) (default no) ⟵ yes the stray ) is in the original, I don't make the rules 💀
• -pol policy file — default empty
• -uwa — userWithAuth attribute clear (default set)
• -nalg name hash algorithm (sha1, sha256, sha384) — default sha256
• -halg scheme hash algorithm (sha1, sha256, sha384) — default sha256

🦋 sessions

• -se[0-2] — session handle / attributes (default PWAP)
  • 01 — continue
  • 20 — command decrypt
  • 40 — response encrypt

---

and then. AND THEN. bestie, another one:

--version is not a valid option

like. okay. noted. 💀

and then it just... says the whole thing again:

createprimary creates a primary storage key

Runs TPM2_CreatePrimary

• -hi hierarchy (e, o, p, n) — default null
• -pwdp password for hierarchy — default empty
• -pwdpi password file name for hierarchy — default empty
• -pwdk password for key — default empty
• -iu inPublic unique field file — default none
• -opu public key file name — default do not save
• oipem public key PEM format file name — default do not save
• -tk output ticket file name
• -ch output creation hash file name

Asymmetric Key Algorithm:

• -rsa — default ✨
• -ecc curve

curves:

• bnp256
• nistp256
• nistp384

Key attributes:

• -bl data blob for unseal (create only)
• -if data file name
• -den — decryption, RSA, not storage, NULL scheme
• -deo — decryption, RSA, not storage, OAEP scheme
• -des — encryption/decryption, AES symmetric
• -116 — for TPM rev 116 compatibility
• -st — storage [default for primary keys]
• -si — signing
• -sir — restricted signing
• -dau — create unrestricted ECDAA key pair
• -dar — create restricted ECDAA key pair
• -kh — keyed hash (hmac)
• -dp — derivation parent
• -gp — general purpose, not storage
• -kt — (can be specified more than once)
  • f — fixedTPM (default for primary keys and derivation parents)
  • p — fixedParent (default for primary keys and derivation parents)
  • nf — no fixedTPM (default for non-primary keys)
  • np — no fixedParent (default for non-primary keys)
• -da — object subject to DA protection) (default no)
• -pol policy file — default empty
• -uwa — userWithAuth attribute clear (default set)
• -nalg name hash algorithm (sha1, sha256, sha384) — default sha256
• -halg scheme hash algorithm (sha1, sha256, sha384) — default sha256
• -se[0-2] — session handle / attributes (default PWAP)
  • 01 — continue
  • 20 — command decrypt
  • 40 — response encrypt

periodt. that's the description, twice, because the page said so and I respect the page. 💅

---

🌈 SEE ALSO

the full documentation for createprimary is maintained as a Texinfo manual. and if the info and createprimary programs are properly installed at your site, then this:

info createprimary

should give you access to the complete manual. no cap, that's the whole see-also. 🫶

---

sign-off time, bestie: this page's footer reads createprimary, dated July 2017, and the title down there is CREATEPRIMARY(1) — so that's createprimary, July 2017, CREATEPRIMARY(1). iconic. slay. bye 💖✨🎀