TPM2KEY-TOOL(8)

✨ TPM2KEY-TOOL(8) ✨

okay so bestie, welcome to the TPM2KEY-TOOL(8) page — the manual for parsing and comparing TPM 2.0 keys. yes, that's the whole vibe. let's get into it 💅

---

🌸 NAME 🌸

tpm2key-tool — parse and compare TPM 2.0 key files 🎀

🦋 SYNOPSIS 🦋

tpm2key-tool [-d|--debug] parse key-file

tpm2key-tool [-d|--debug] cmp key-file-1 key-file-2

tpm2key-tool [-h|--help]

💖 DESCRIPTION 💖

tpm2key-tool is a command-line utility that's literally built to parse, inspect, and compare TPM 2.0 private key files. no cap, that's the job. and these files? they're typically stored in the standard ASN.1 DER-encoded format, which is defined by the TPM2.0 key file specification — aka the TSS PrivKey format. iykyk 😌

🌈 OPTIONS 🌈

here's the full list of options tpm2key-tool recognizes, bestie — every single one:

• -d, --debug — turns on verbose debug logging. so if you're nosy (same) this is your moment 🔍
• -h, --help — shows a help message and then bounces. exit stage left 🫶

⭐ SUBCOMMANDS ⭐

• parse key-file — decodes the TPM 2.0 key file you point it at and prints a detailed, human-readable summary. iconic. that summary includes structural elements like:
  • the TSSPrivKey type (OID)
  • the key's description (if it's present — sometimes it's not, and that's fine)
  • the parent handle and public key
  • any option or authorization policies, including the policy steps and command codes 👑
• cmp key-file-1 key-file-2 — compares two TPM 2.0 key files to figure out whether they share the same base key. this one's especially useful for verifying if two keys were derived or wrapped under the same parent, or if they represent the same underlying TPM object but with different policies. so basically a vibe check for keys 🧚

💀 EXIT STATUS 💀

the utility returns these exit status codes — memorize them fr fr:

• 0 — success. and for the cmp subcommand specifically, it means both key files represent or share the same base key 🎉
• 1 — returned by the cmp subcommand only: the keys are valid but they do not share the same base key. so valid, just not matching 😭
• 2 — an error happened. like invalid usage, or a specified key file couldn't be read, parsed, or decoded. sad times 🙈

🔥 SEE ALSO 🔥

pcr-oracle(8)

---

and that's the whole page, bestie 🍓 version 0.6.6, dated September 18, 2026 — go forth and parse those keys 💜✨