simple-tpm-pk11(7)

💖 simple-tpm-pk11 💖

okay bestie, sit down, grab a strawberry 🍓, because we're talking about simple-tpm-pk11 — that's the page you're reading, section 7 of the manual, and it's literally a PKCS11 provider for TPM chips. ✨

---

🦋 NAME 🦋

simple-tpm-pk11 — the simple PKCS11 provider for TPM chips. that's it, that's the name, and it's giving main character energy fr fr.

---

✨ DESCRIPTION ✨

so like, simple-tpm-pk11 is a PKCS11 provider for TPM chips. its whole primary purpose — and I mean the entire point, no cap — is to protect SSH client keys so that they literally cannot be copied or stolen if the machine they're chilling on gets compromised. 🛡️

think of it like this: your keys stay safe in the TPM, and if some hacker girly pops onto your machine, she's not walking away with your keys. periodt. 💅

---

🎀 OPTIONS 🎀

okay so here's the thing: PKCS11 modules are .so files, right? they get loaded by other binaries. and because of that, they don't take command line options. no flags, no -h, nothing. so instead, simple-tpm-pk11 options get set up through environment variables. slay. 🌈

• SIMPLE_TPM_PK11_DEBUG — if you set this, it enables debug level logging. that's it, just set it and watch the logs go brrr. 🔥
• SIMPLE_TPM_PK11_CONFIG=/path/to/config — this overrides the default config location. and the default? it's ~/.simple-tpm-pk11/config. 🏠
• SIMPLE_TPM_PK11_LOG_STDERR — if set, this copies all the log output to STDERR. all of it. every last crumb. 🫶

---

🌸 CONFIGURATION FILE 🌸

the config file is a key/value situation, and comment lines start with "#". classic. iconic.

• key key file — full path to the key file, or a path relative to ~/.simple-tpm-pk11. and listen — this is the only required configuration option. everything else is optional, bestie. 👑
• debug — enables debug level logging. same vibe as the env var, just in file form. ✨
• srk_pin PIN — sets the SRK PIN. and the default? the Well Known Secret, which is literally 20 nulls. not me being dramatic, that's just what it is. 💀
• key_pin PIN — sets the key PIN. 🔑
• log log file — full path to the log file, or a path relative to ~/.simple-tpm-pk11. 📝

---

💜 EXAMPLES 💜

# Load key from ~/.simple-tpm-pk11/my.key.
key my.key

# Load key from /keys/foo/my.key, and the empty string as SRK PIN.
key /keys/foo/my.key
srk_pin

like, look at that. first one loads a key from ~/.simple-tpm-pk11/my.key. second one loads a key from /keys/foo/my.key and uses the empty string as the SRK PIN. obsessed. 🫶

---

🔧 TPM-TROUBLESHOOTING 🔧

TODO.

yeah. that's the whole section. we love a placeholder. 💀

---

🩺 DIAGNOSTICS 🩺

most errors are probably gonna be about interacting with the TPM chip, ngl. and the fix for most of them? reset the TPM chip and take ownership. that should take care of most of them, fr fr. and if you're lost, go peek at the TPM-TROUBLESHOOTING section. ✨

---

🙈 BUGS 🙈

okay so this is the part where we're honest: the password is read from stdin without turning off echo. it should be read from the terminal without echo. it's not. that's the bug. 😭

lowkey important: your password will be visible while you type it. just so you know. 💀

---

🌈 SEE ALSO 🌈

• stpm-keygen(1)
• stpm-sign(1)

go read those too, bestie, they're the supporting cast. 💖

---

👑 AUTHOR 👑

Simple-TPM-PK11 was written By Thomas Habets <habets@google.com> / <thomas@habets.se>.

and if you wanna clone it (which you should, obviously):

git clone https://github.com/ThomasHabets/simple-tpm-pk11.git

---

and that's the whole page, bestie!! this was simple-tpm-pk11, manual section 7, and the source is simple-tpm-pk11, dated 1th December, 2013. yeah, "1th" — I'm not fixing it, it's iconic, it's staying. 🎀✨ thanks for reading, now go protect those SSH keys. mwah. 💅🦋